theory Retype_C

lemma createObject_ccorres:
  notes APITypecapBits_simps[simp] =
          APIType_capBits_def[split_simps
          object_type.split apiobject_type.split]
  shows
    "ccorres ccap_relation ret__struct_cap_C_'
     (createObject_hs_preconds regionBase newType userSize isdev)
     (createObject_c_preconds regionBase newType userSize isdev)
     []
     (createObject newType regionBase userSize isdev)
     (Call createObject_'proc)" proof - note if_cong[cong] have gsCNodes_update:
    "\<And>f. (\<lambda>ks. ks \<lparr>gsCNodes := f (gsCNodes ks)\<rparr>) = gsCNodes_update f" by (rule ext) simp show ?thesis apply (clarsimp simp: createObject_c_preconds_def
                        createObject_hs_preconds_def) apply (rule ccorres_gen_asm_state) apply (cinit lift: t_' regionBase_' userSize_' deviceMemory_') apply (rule ccorres_cond_seq) 
   (* Architecture specific objects. *)
    apply (rule_tac
           Q="createObject_hs_preconds regionBase newType userSize isdev" and
           S="createObject_c_preconds1 regionBase newType userSize isdev" and
           R="createObject_hs_preconds regionBase newType userSize isdev" and
           T="createObject_c_preconds1 regionBase newType userSize isdev"
           in ccorres_Cond_rhs) apply (subgoal_tac "toAPIType newType = None") apply clarsimp apply (rule ccorres_rhs_assoc)+ apply (rule ccorres_guard_imp) apply (ctac (no_vcg) add: Arch_createObject_ccorres) apply (rule ccorres_return_C_Seq) apply (rule ccorres_return_C) apply clarsimp apply clarsimp apply clarsimp apply wp[1] apply clarsimp apply (clarsimp simp: createObject_c_preconds_def
                           region_actually_is_bytes
                           region_actually_is_bytes_def) apply (clarsimp simp: object_type_from_H_def
                          Kernel_C_defs toAPIType_def
                          nAPIObjects_def word_sle_def createObject_c_preconds_def
                          word_le_nat_alt
                   split: apiobject_type.splits object_type.splits) apply (subgoal_tac "\<exists>apiType. newType = APIObjectType apiType") apply clarsimp apply (rule ccorres_guard_imp) apply (rule_tac apiType=apiType in ccorres_apiType_split) 

          (* Untyped *)
           apply (clarsimp simp: Kernel_C_defs object_type_from_H_def
                                toAPIType_def nAPIObjects_def word_sle_def
                        intro!: Corres_UL_C.ccorres_cond_empty
                                Corres_UL_C.ccorres_cond_univ ccorres_rhs_assoc) apply (rule_tac
             A ="createObject_hs_preconds regionBase
                   (APIObjectType apiobject_type.Untyped)
                    (unat (userSizea :: word32)) isdev" and
             A'=UNIV in
             ccorres_guard_imp) apply (rule ccorres_symb_exec_r) apply (rule ccorres_return_C, simp, simp, simp) apply vcg apply (rule conseqPre, vcg, clarsimp) apply simp apply (clarsimp simp: ccap_relation_def cap_to_H_def
                                getObjectSize_def apiGetObjectSize_def
                                cap_untyped_cap_lift to_bool_eq_0 aligned_add_aligned
                         split: option.splits) apply (subst is_aligned_neg_mask_eq [OF is_aligned_weaken]) apply (erule range_cover.aligned) apply (clarsimp simp:APIType_capBits_def untypedBits_defs) apply (clarsimp simp: cap_untyped_cap_lift_def) apply (subst word_le_mask_eq, clarsimp simp: mask_def, unat_arith,
                 auto simp: to_bool_eq_0 word_bits_conv untypedBits_defs split:if_splits)[1] 

         (* TCB *)
          apply (clarsimp simp: Kernel_C_defs object_type_from_H_def
                               toAPIType_def nAPIObjects_def word_sle_def
                       intro!: Corres_UL_C.ccorres_cond_empty
                               Corres_UL_C.ccorres_cond_univ ccorres_rhs_assoc) apply (rule_tac
           A ="createObject_hs_preconds regionBase
                 (APIObjectType apiobject_type.TCBObject) (unat userSizea) isdev" and
           A'="createObject_c_preconds1 regionBase
                 (APIObjectType apiobject_type.TCBObject) (unat userSizea) isdev" in
            ccorres_guard_imp2) apply (rule ccorres_symb_exec_r) apply (ccorres_remove_UNIV_guard) apply (simp add: hrs_htd_update) apply (ctac (c_lines 4) add: ccorres_placeNewObject_tcb[simplified]) apply simp apply (rule ccorres_pre_curDomain) apply ctac apply (rule ccorres_symb_exec_r) apply (rule ccorres_return_C, simp, simp, simp) apply vcg apply (rule conseqPre, vcg, clarsimp) apply wp apply vcg apply (simp add: obj_at'_real_def) apply (wp placeNewObject_ko_wp_at') apply vcg apply clarsimp apply vcg apply (clarsimp simp: CPSR_def) apply (rule conseqPre, vcg, clarsimp) apply (clarsimp simp: createObject_hs_preconds_def
                               createObject_c_preconds_def) apply (frule invs_pspace_aligned') apply (frule invs_pspace_distinct') apply (frule invs_queues) apply (frule invs_sym') apply (simp add: getObjectSize_def objBits_simps' word_bits_conv apiGetObjectSize_def
                          new_cap_addrs_def projectKO_opt_tcb) apply (clarsimp simp: range_cover.aligned
                               region_actually_is_bytes_def APIType_capBits_def) apply (frule(1) ghost_assertion_size_logic_no_unat) apply (clarsimp simp: ccap_relation_def cap_to_H_def getObjectSize_def
                               apiGetObjectSize_def cap_thread_cap_lift aligned_add_aligned
                        split: option.splits) apply (clarsimp simp: ctcb_ptr_to_tcb_ptr_def ctcb_offset_defs
                               tcb_ptr_to_ctcb_ptr_def
                               invs_valid_objs' invs_urz isFrameType_def) apply (subst is_aligned_neg_mask_weaken) apply (rule is_aligned_add[where n=ctcb_size_bits, unfolded ctcb_size_bits_def]) apply (clarsimp elim!: is_aligned_weaken
                             dest!: range_cover.aligned) apply (clarsimp simp: is_aligned_def) apply (clarsimp simp: word_bits_def) apply simp apply clarsimp 

        (* Endpoint *)
         apply (clarsimp simp: Kernel_C_defs object_type_from_H_def
                              toAPIType_def nAPIObjects_def word_sle_def
                      intro!: ccorres_cond_empty ccorres_cond_univ
                              ccorres_rhs_assoc) apply (rule_tac
           A ="createObject_hs_preconds regionBase
                 (APIObjectType apiobject_type.EndpointObject)
                 (unat (userSizea :: machine_word)) isdev" and
           A'="createObject_c_preconds1 regionBase
                 (APIObjectType apiobject_type.EndpointObject)
                 (unat userSizea) isdev" in
           ccorres_guard_imp2) apply (ccorres_remove_UNIV_guard) apply (simp add: hrs_htd_update) apply (ctac (no_vcg) pre only: add: ccorres_placeNewObject_endpoint) apply (rule ccorres_symb_exec_r) apply (rule ccorres_return_C, simp, simp, simp) apply vcg apply (rule conseqPre, vcg, clarsimp) apply wp apply (clarsimp simp: ccap_relation_def cap_to_H_def getObjectSize_def
                               objBits_simps apiGetObjectSize_def epSizeBits_def
                               cap_endpoint_cap_lift
                        split: option.splits
                        dest!: range_cover.aligned) apply (clarsimp simp: createObject_hs_preconds_def isFrameType_def) apply (frule invs_pspace_aligned') apply (frule invs_pspace_distinct') apply (frule invs_queues) apply (frule invs_sym') apply (auto simp: getObjectSize_def objBits_simps
                          apiGetObjectSize_def
                          epSizeBits_def word_bits_conv
                   elim!: is_aligned_no_wrap')[1] 

       (* Notification *)
        apply (clarsimp simp: createObject_c_preconds_def) apply (clarsimp simp: getObjectSize_def objBits_simps apiGetObjectSize_def
                             epSizeBits_def word_bits_conv word_sle_def word_sless_def) apply (clarsimp simp: Kernel_C_defs object_type_from_H_def
                             toAPIType_def nAPIObjects_def word_sle_def
                     intro!: ccorres_cond_empty ccorres_cond_univ
                             ccorres_rhs_assoc) apply (rule_tac
         A ="createObject_hs_preconds regionBase
               (APIObjectType apiobject_type.NotificationObject)
               (unat (userSizea :: word32)) isdev" and
         A'="createObject_c_preconds1 regionBase
               (APIObjectType apiobject_type.NotificationObject)
               (unat userSizea) isdev" in
         ccorres_guard_imp2) apply (ccorres_remove_UNIV_guard) apply (simp add: hrs_htd_update) apply (ctac (no_vcg) pre only: add: ccorres_placeNewObject_notification) apply (rule ccorres_symb_exec_r) apply (rule ccorres_return_C, simp, simp, simp) apply vcg apply (rule conseqPre, vcg, clarsimp) apply wp apply (clarsimp simp: ccap_relation_def cap_to_H_def getObjectSize_def
                              apiGetObjectSize_def ntfnSizeBits_def objBits_simps
                              cap_notification_cap_lift
                       dest!: range_cover.aligned
                       split: option.splits) apply (clarsimp simp: createObject_hs_preconds_def isFrameType_def) apply (frule invs_pspace_aligned') apply (frule invs_pspace_distinct') apply (frule invs_queues) apply (frule invs_sym') apply (auto simp: getObjectSize_def objBits_simps apiGetObjectSize_def
                         ntfnSizeBits_def word_bits_conv
                  elim!: is_aligned_no_wrap')[1] 

      (* CapTable *)
       apply (clarsimp simp: createObject_c_preconds_def) apply (clarsimp simp: getObjectSize_def objBits_simps apiGetObjectSize_def
                            ntfnSizeBits_def word_bits_conv) apply (clarsimp simp: Kernel_C_defs object_type_from_H_def toAPIType_def nAPIObjects_def
                            word_sle_def word_sless_def zero_le_sint_32
                    intro!: ccorres_cond_empty ccorres_cond_univ ccorres_rhs_assoc
                            ccorres_move_c_guards ccorres_Guard_Seq) apply (rule_tac
         A ="createObject_hs_preconds regionBase
               (APIObjectType apiobject_type.CapTableObject)
               (unat (userSizea :: word32)) isdev" and
         A'="createObject_c_preconds1 regionBase
               (APIObjectType apiobject_type.CapTableObject)
               (unat userSizea) isdev" in
         ccorres_guard_imp2) apply (simp add:field_simps hrs_htd_update) apply (ccorres_remove_UNIV_guard) apply (ctac pre only: add: ccorres_placeNewObject_captable) apply (subst gsCNodes_update) apply (ctac add: gsCNodes_update_ccorres) apply (rule ccorres_symb_exec_r) apply (rule ccorres_return_C, simp, simp, simp) apply vcg apply (rule conseqPre, vcg, clarsimp) apply (rule hoare_triv[of \<top>], simp add:hoare_TrueI) apply vcg apply wp apply vcg apply (rule conjI) apply (clarsimp simp: createObject_hs_preconds_def isFrameType_def) apply (frule invs_pspace_aligned') apply (frule invs_pspace_distinct') apply (frule invs_queues) apply (frule invs_sym') apply (frule(1) ghost_assertion_size_logic_no_unat) apply (clarsimp simp: getObjectSize_def objBits_simps apiGetObjectSize_def
                             cteSizeBits_def word_bits_conv add.commute createObject_c_preconds_def
                             region_actually_is_bytes_def invs_valid_objs' invs_urz
                      elim!: is_aligned_no_wrap'
                       dest: word_of_nat_le)[1] apply (clarsimp simp: createObject_hs_preconds_def hrs_htd_update isFrameType_def) apply (frule range_cover.strong_times_32[folded addr_card_wb], simp+) apply (subst h_t_array_valid_retyp, simp+) apply (simp add: power_add cte_C_size objBits_defs) apply (frule range_cover.aligned) apply (clarsimp simp: ccap_relation_def cap_to_H_def
                            cap_cnode_cap_lift getObjectSize_def
                            apiGetObjectSize_def cteSizeBits_def
                            objBits_simps field_simps is_aligned_power2
                            addr_card_wb is_aligned_weaken[where y=word_size_bits]
                            is_aligned_neg_mask
                     split: option.splits) apply (subst word_le_mask_eq[symmetric, THEN eqTrueI]) apply (clarsimp simp: mask_def) apply unat_arith apply (clarsimp simp: word_bits_conv) apply simp apply unat_arith apply auto[1] apply (clarsimp simp: createObject_c_preconds_def) apply (intro impI conjI, simp_all)[1] apply (clarsimp simp: nAPIObjects_def object_type_from_H_def Kernel_C_defs
                  split: object_type.splits) apply (clarsimp simp: createObject_c_preconds_def
                        createObject_hs_preconds_def) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) (createObject_c_preconds regionBase newType userSize isdev) [] (global.createObject newType regionBase userSize isdev) (Call createObject_'proc) proof (state)
goal (1 subgoal):
 1. ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) (createObject_c_preconds regionBase newType userSize isdev) [] (global.createObject newType regionBase userSize isdev) (Call createObject_'proc) proof (state)
this:
\<lbrakk>?b = ?c; ?c \<Longrightarrow> ?x = ?u; \<not> ?c \<Longrightarrow> ?y = ?v\<rbrakk> \<Longrightarrow> (if ?b then ?x else ?y) = (if ?c then ?u else ?v)

goal (1 subgoal):
 1. ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) (createObject_c_preconds regionBase newType userSize isdev) [] (global.createObject newType regionBase userSize isdev) (Call createObject_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>f. (\<lambda>ks. ks\<lparr>gsCNodes := f (gsCNodes ks)\<rparr>) = gsCNodes_update f proof (state)
this:
(\<lambda>ks. ks\<lparr>gsCNodes := ?f2 (gsCNodes ks)\<rparr>) = gsCNodes_update ?f2

goal (1 subgoal):
 1. ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) (createObject_c_preconds regionBase newType userSize isdev) [] (global.createObject newType regionBase userSize isdev) (Call createObject_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) (createObject_c_preconds regionBase newType userSize isdev) [] (global.createObject newType regionBase userSize isdev) (Call createObject_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres ccap_relation ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s) and (\<lambda>y. regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType))) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)} \<inter> \<lbrace>object_type_from_H newType = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = isdev\<rbrace>) [] (global.createObject newType regionBase userSize isdev) (Call createObject_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>s. regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) ({s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)} \<inter> \<lbrace>object_type_from_H newType = \<acute>t\<rbrace> \<inter> \<lbrace>PTR(unit) regionBase = \<acute>regionBase\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = userSize\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = isdev\<rbrace>) [] (global.createObject newType regionBase userSize isdev) (Call createObject_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q2943 deviceMemory userSizea regionBasea t) (?Q'2943 deviceMemory userSizea regionBasea t) [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (IF SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t THEN
  \<acute>ret__struct_cap_C :== CALL Arch_createObject_'proc(t,regionBasea,userSizea,deviceMemory);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 2. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q2943 deviceMemory userSizea regionBasea t s \<and> s' \<in> ?Q'2943 deviceMemory userSizea regionBasea t proof (prove)
goal (2 subgoals):
 1. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q2943 deviceMemory userSizea regionBasea t) (?Q'2943 deviceMemory userSizea regionBasea t) [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (IF SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t THEN
  \<acute>ret__struct_cap_C :== CALL Arch_createObject_'proc(t,regionBasea,userSizea,deviceMemory);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_';;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
ELSE
  SKIP;;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 2. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q2943 deviceMemory userSizea regionBasea t s \<and> s' \<in> ?Q'2943 deviceMemory userSizea regionBasea t proof (prove)
goal (2 subgoals):
 1. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q2943 deviceMemory userSizea regionBasea t) (?Q'2943 deviceMemory userSizea regionBasea t) [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (IF SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t THEN
  \<acute>ret__struct_cap_C :== CALL Arch_createObject_'proc(t,regionBasea,userSizea,deviceMemory);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_';;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
ELSE
  SKIP;;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI
FI)
 2. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ?Q2943 deviceMemory userSizea regionBasea t s \<and> s' \<in> ?Q'2943 deviceMemory userSizea regionBasea t proof (prove)
goal (3 subgoals):
 1. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)} [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (\<acute>ret__struct_cap_C :== CALL Arch_createObject_'proc(t,regionBasea,userSizea,deviceMemory);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_';;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 2. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)} [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (SKIP;;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 3. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (4 subgoals):
 1. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t; toAPIType newType = None\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)} [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (\<acute>ret__struct_cap_C :== CALL Arch_createObject_'proc(t,regionBasea,userSizea,deviceMemory);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_';;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 2. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> toAPIType newType = None
 3. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)} [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (SKIP;;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 4. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (4 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType (unat userSizea) (to_bool deviceMemory)) {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits newType (unat userSizea)) 0)} [SKIP] (do archCap <- Arch.createObject newType regionBase (unat userSizea) (to_bool deviceMemory);
return (capability.ArchObjectCap archCap)
od) (\<acute>ret__struct_cap_C :== CALL Arch_createObject_'proc(object_type_from_H newType,PTR(unit) regionBase,userSizea,deviceMemory);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_';;
Cond (if object_type_from_H newType = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H newType = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H newType = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H newType = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H newType = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 2. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> toAPIType newType = None
 3. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)} [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (SKIP;;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 4. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (4 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType (unat userSizea) (to_bool deviceMemory)) {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits newType (unat userSizea)) 0)} [SKIP] (do archCap <- Arch.createObject newType regionBase (unat userSizea) (to_bool deviceMemory);
return (capability.ArchObjectCap archCap)
od) (\<acute>ret__struct_cap_C :== CALL Arch_createObject_'proc(object_type_from_H newType,PTR(unit) regionBase,userSizea,deviceMemory);;
(return_C ret__struct_cap_C_'_update ret__struct_cap_C_';;
Cond (if object_type_from_H newType = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H newType = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H newType = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H newType = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H newType = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP)))))))
 2. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> toAPIType newType = None
 3. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)} [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (SKIP;;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 4. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q2972 deviceMemory userSizea) (?Q'2972 deviceMemory userSizea) [SKIP] (do archCap <- Arch.createObject newType regionBase (unat userSizea) (to_bool deviceMemory);
return (capability.ArchObjectCap archCap)
od) (\<acute>ret__struct_cap_C :== CALL Arch_createObject_'proc(object_type_from_H newType,PTR(unit) regionBase,userSizea,deviceMemory);;
(return_C ret__struct_cap_C_'_update ret__struct_cap_C_';;
Cond (if object_type_from_H newType = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H newType = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H newType = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H newType = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H newType = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP)))))))
 2. \<And>deviceMemory userSizea s. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; createObject_hs_preconds regionBase newType (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ?Q2972 deviceMemory userSizea s
 3. \<And>deviceMemory userSizea s. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits newType (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> ?Q'2972 deviceMemory userSizea
 4. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> toAPIType newType = None
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)} [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (SKIP;;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemory userSizea rv ret__struct_cap_C. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; ccap_relation (capability.ArchObjectCap rv) ret__struct_cap_C\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q2978 deviceMemory userSizea rv) (?Q'2978 deviceMemory userSizea rv ret__struct_cap_C) [SKIP] (return (capability.ArchObjectCap rv)) (return_C ret__struct_cap_C_'_update (\<lambda>s. ret__struct_cap_C);;
Cond (if object_type_from_H newType = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H newType = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H newType = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H newType = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H newType = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 2. \<And>deviceMemory userSizea. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType\<rbrakk> \<Longrightarrow> \<lbrace>?R2978 deviceMemory userSizea\<rbrace> Arch.createObject newType regionBase (unat userSizea) (to_bool deviceMemory) \<lbrace>?Q2978 deviceMemory userSizea\<rbrace>
 3. \<And>deviceMemory userSizea s. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; createObject_hs_preconds regionBase newType (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> (createObject_hs_preconds regionBase newType (unat userSizea) (to_bool deviceMemory) and ?R2978 deviceMemory userSizea) s
 4. \<And>deviceMemory userSizea s. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits newType (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. deviceMemory_'_update (\<lambda>_. deviceMemory) (userSize_'_update (\<lambda>_. userSizea) (regionBase_'_update (\<lambda>_. PTR(unit) regionBase) (t_'_update (\<lambda>_. object_type_from_H newType) s))) \<in> createObject_c_preconds regionBase newType (unat userSizea) (to_bool deviceMemory)} \<inter> {s'. \<forall>t rv. ccap_relation (capability.ArchObjectCap rv) (ret__struct_cap_C_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__struct_cap_C_' := ret__struct_cap_C_' t\<rparr> \<in> ?Q'2978 deviceMemory userSizea rv (ret__struct_cap_C_' t)}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> toAPIType newType = None
 6. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)} [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (SKIP;;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 7. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemory userSizea rv ret__struct_cap_C. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; ccap_relation (capability.ArchObjectCap rv) ret__struct_cap_C\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q2978 deviceMemory userSizea rv) (?Q'2978 deviceMemory userSizea rv ret__struct_cap_C) [SKIP] (return (capability.ArchObjectCap rv)) (return_C ret__struct_cap_C_'_update (\<lambda>s. ret__struct_cap_C))
 2. \<And>deviceMemory userSizea. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType\<rbrakk> \<Longrightarrow> \<lbrace>?R2978 deviceMemory userSizea\<rbrace> Arch.createObject newType regionBase (unat userSizea) (to_bool deviceMemory) \<lbrace>?Q2978 deviceMemory userSizea\<rbrace>
 3. \<And>deviceMemory userSizea s. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; createObject_hs_preconds regionBase newType (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> (createObject_hs_preconds regionBase newType (unat userSizea) (to_bool deviceMemory) and ?R2978 deviceMemory userSizea) s
 4. \<And>deviceMemory userSizea s. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits newType (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. deviceMemory_'_update (\<lambda>_. deviceMemory) (userSize_'_update (\<lambda>_. userSizea) (regionBase_'_update (\<lambda>_. PTR(unit) regionBase) (t_'_update (\<lambda>_. object_type_from_H newType) s))) \<in> createObject_c_preconds regionBase newType (unat userSizea) (to_bool deviceMemory)} \<inter> {s'. \<forall>t rv. ccap_relation (capability.ArchObjectCap rv) (ret__struct_cap_C_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__struct_cap_C_' := ret__struct_cap_C_' t\<rparr> \<in> ?Q'2978 deviceMemory userSizea rv (ret__struct_cap_C_' t)}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> toAPIType newType = None
 6. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)} [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (SKIP;;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 7. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (9 subgoals):
 1. \<And>deviceMemory userSizea rv ret__struct_cap_C s f. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; ccap_relation (capability.ArchObjectCap rv) ret__struct_cap_C\<rbrakk> \<Longrightarrow> ret__struct_cap_C_' (global_exn_var_'_update f (s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C\<rparr>)) = ret__struct_cap_C
 2. \<And>deviceMemory userSizea rv ret__struct_cap_C s f. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; ccap_relation (capability.ArchObjectCap rv) ret__struct_cap_C\<rbrakk> \<Longrightarrow> globals (ret__struct_cap_C_'_update f s) = globals s
 3. \<And>deviceMemory userSizea rv ret__struct_cap_C. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; ccap_relation (capability.ArchObjectCap rv) ret__struct_cap_C\<rbrakk> \<Longrightarrow> wfhandlers [SKIP]
 4. \<And>deviceMemory userSizea. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType\<rbrakk> \<Longrightarrow> \<lbrace>?R2978 deviceMemory userSizea\<rbrace> Arch.createObject newType regionBase (unat userSizea) (to_bool deviceMemory) \<lbrace>\<lambda>rv _. True\<rbrace>
 5. \<And>deviceMemory userSizea s. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; createObject_hs_preconds regionBase newType (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> (createObject_hs_preconds regionBase newType (unat userSizea) (to_bool deviceMemory) and ?R2978 deviceMemory userSizea) s
 6. \<And>deviceMemory userSizea s. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits newType (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. deviceMemory_'_update (\<lambda>_. deviceMemory) (userSize_'_update (\<lambda>_. userSizea) (regionBase_'_update (\<lambda>_. PTR(unit) regionBase) (t_'_update (\<lambda>_. object_type_from_H newType) s))) \<in> createObject_c_preconds regionBase newType (unat userSizea) (to_bool deviceMemory)} \<inter> {s'. \<forall>t rv. ccap_relation (capability.ArchObjectCap rv) (ret__struct_cap_C_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__struct_cap_C_' := ret__struct_cap_C_' t\<rparr> \<in> \<lbrace>ccap_relation (capability.ArchObjectCap rv) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> toAPIType newType = None
 8. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)} [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (SKIP;;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 9. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea rv ret__struct_cap_C s f. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; ccap_relation (capability.ArchObjectCap rv) ret__struct_cap_C\<rbrakk> \<Longrightarrow> globals (ret__struct_cap_C_'_update f s) = globals s
 2. \<And>deviceMemory userSizea rv ret__struct_cap_C. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; ccap_relation (capability.ArchObjectCap rv) ret__struct_cap_C\<rbrakk> \<Longrightarrow> wfhandlers [SKIP]
 3. \<And>deviceMemory userSizea. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType\<rbrakk> \<Longrightarrow> \<lbrace>?R2978 deviceMemory userSizea\<rbrace> Arch.createObject newType regionBase (unat userSizea) (to_bool deviceMemory) \<lbrace>\<lambda>rv _. True\<rbrace>
 4. \<And>deviceMemory userSizea s. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; createObject_hs_preconds regionBase newType (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> (createObject_hs_preconds regionBase newType (unat userSizea) (to_bool deviceMemory) and ?R2978 deviceMemory userSizea) s
 5. \<And>deviceMemory userSizea s. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits newType (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. deviceMemory_'_update (\<lambda>_. deviceMemory) (userSize_'_update (\<lambda>_. userSizea) (regionBase_'_update (\<lambda>_. PTR(unit) regionBase) (t_'_update (\<lambda>_. object_type_from_H newType) s))) \<in> createObject_c_preconds regionBase newType (unat userSizea) (to_bool deviceMemory)} \<inter> {s'. \<forall>t rv. ccap_relation (capability.ArchObjectCap rv) (ret__struct_cap_C_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__struct_cap_C_' := ret__struct_cap_C_' t\<rparr> \<in> \<lbrace>ccap_relation (capability.ArchObjectCap rv) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>}
 6. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> toAPIType newType = None
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)} [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (SKIP;;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemory userSizea rv ret__struct_cap_C. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; ccap_relation (capability.ArchObjectCap rv) ret__struct_cap_C\<rbrakk> \<Longrightarrow> wfhandlers [SKIP]
 2. \<And>deviceMemory userSizea. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType\<rbrakk> \<Longrightarrow> \<lbrace>?R2978 deviceMemory userSizea\<rbrace> Arch.createObject newType regionBase (unat userSizea) (to_bool deviceMemory) \<lbrace>\<lambda>rv _. True\<rbrace>
 3. \<And>deviceMemory userSizea s. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; createObject_hs_preconds regionBase newType (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> (createObject_hs_preconds regionBase newType (unat userSizea) (to_bool deviceMemory) and ?R2978 deviceMemory userSizea) s
 4. \<And>deviceMemory userSizea s. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits newType (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. deviceMemory_'_update (\<lambda>_. deviceMemory) (userSize_'_update (\<lambda>_. userSizea) (regionBase_'_update (\<lambda>_. PTR(unit) regionBase) (t_'_update (\<lambda>_. object_type_from_H newType) s))) \<in> createObject_c_preconds regionBase newType (unat userSizea) (to_bool deviceMemory)} \<inter> {s'. \<forall>t rv. ccap_relation (capability.ArchObjectCap rv) (ret__struct_cap_C_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__struct_cap_C_' := ret__struct_cap_C_' t\<rparr> \<in> \<lbrace>ccap_relation (capability.ArchObjectCap rv) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> toAPIType newType = None
 6. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)} [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (SKIP;;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 7. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType\<rbrakk> \<Longrightarrow> \<lbrace>?R2978 deviceMemory userSizea\<rbrace> Arch.createObject newType regionBase (unat userSizea) (to_bool deviceMemory) \<lbrace>\<lambda>rv _. True\<rbrace>
 2. \<And>deviceMemory userSizea s. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; createObject_hs_preconds regionBase newType (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> (createObject_hs_preconds regionBase newType (unat userSizea) (to_bool deviceMemory) and ?R2978 deviceMemory userSizea) s
 3. \<And>deviceMemory userSizea s. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits newType (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. deviceMemory_'_update (\<lambda>_. deviceMemory) (userSize_'_update (\<lambda>_. userSizea) (regionBase_'_update (\<lambda>_. PTR(unit) regionBase) (t_'_update (\<lambda>_. object_type_from_H newType) s))) \<in> createObject_c_preconds regionBase newType (unat userSizea) (to_bool deviceMemory)} \<inter> {s'. \<forall>t rv. ccap_relation (capability.ArchObjectCap rv) (ret__struct_cap_C_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__struct_cap_C_' := ret__struct_cap_C_' t\<rparr> \<in> \<lbrace>ccap_relation (capability.ArchObjectCap rv) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>}
 4. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> toAPIType newType = None
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)} [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (SKIP;;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemory userSizea s. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; createObject_hs_preconds regionBase newType (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> (createObject_hs_preconds regionBase newType (unat userSizea) (to_bool deviceMemory) and (\<lambda>s. True)) s
 2. \<And>deviceMemory userSizea s. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits newType (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. deviceMemory_'_update (\<lambda>_. deviceMemory) (userSize_'_update (\<lambda>_. userSizea) (regionBase_'_update (\<lambda>_. PTR(unit) regionBase) (t_'_update (\<lambda>_. object_type_from_H newType) s))) \<in> createObject_c_preconds regionBase newType (unat userSizea) (to_bool deviceMemory)} \<inter> {s'. \<forall>t rv. ccap_relation (capability.ArchObjectCap rv) (ret__struct_cap_C_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__struct_cap_C_' := ret__struct_cap_C_' t\<rparr> \<in> \<lbrace>ccap_relation (capability.ArchObjectCap rv) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>}
 3. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> toAPIType newType = None
 4. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)} [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (SKIP;;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 5. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (4 subgoals):
 1. \<And>deviceMemory userSizea s. \<lbrakk>SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H newType; toAPIType newType = None; isdev = to_bool deviceMemory; userSize = unat userSizea; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits newType (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits newType (unat userSizea)) (APIType_capBits newType (unat userSizea)) (Suc 0); newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits newType (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. deviceMemory_'_update (\<lambda>_. deviceMemory) (userSize_'_update (\<lambda>_. userSizea) (regionBase_'_update (\<lambda>_. PTR(unit) regionBase) (t_'_update (\<lambda>_. object_type_from_H newType) s))) \<in> createObject_c_preconds regionBase newType (unat userSizea) (to_bool deviceMemory)} \<inter> {s'. \<forall>t rv. ccap_relation (capability.ArchObjectCap rv) (ret__struct_cap_C_' t) \<longrightarrow> s'\<lparr>globals := globals t, ret__struct_cap_C_' := ret__struct_cap_C_' t\<rparr> \<in> \<lbrace>ccap_relation (capability.ArchObjectCap rv) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>}
 2. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> toAPIType newType = None
 3. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)} [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (SKIP;;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 4. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (3 subgoals):
 1. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> toAPIType newType = None
 2. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)} [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (SKIP;;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 3. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (2 subgoals):
 1. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)} [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (SKIP;;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 2. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (3 subgoals):
 1. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t; \<exists>apiType. newType = APIObjectType apiType\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)} [SKIP] (case toAPIType newType of None \<Rightarrow> do archCap <- Arch.createObject newType regionBase userSize isdev;
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap isdev (PPtr $ fromPPtr regionBase) userSize 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject userSize;
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just userSize else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) userSize 0 0
od) (SKIP;;
IF t = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject THEN
  lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (ptr_val regionBasea + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(UCAST(32 \<rightarrow> 32) (ptr_val \<acute>tcb));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> endpoint_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR_COERCE(unit \<rightarrow> notification_C) regionBasea))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject THEN
  Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (PTR_COERCE(unit \<rightarrow> cte_C) regionBasea))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) (ptr_val regionBasea) (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(UCAST(32 \<rightarrow> 32) userSizea,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  IF t = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject THEN
  \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) (if \<not> \<not> deviceMemory \<noteq> 0 then 1 else 0),UCAST(32 \<rightarrow> 32) userSizea,UCAST(32 \<rightarrow> 32) (ptr_val regionBasea));;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI
FI)
 2. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 3. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (3 subgoals):
 1. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory)) {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)} [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 2. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 3. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q3611 deviceMemory userSizea apiType) (?Q'3611 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 2. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ?Q3611 deviceMemory userSizea apiType s
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> ?Q'3611 deviceMemory userSizea apiType
 4. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 5. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (9 subgoals):
 1. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P1.3615 deviceMemory userSizea apiType) (?P1'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P2.3615 deviceMemory userSizea apiType) (?P2'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> ?P1.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> ?P2.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> ?P1'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> ?P2'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 8. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 9. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (9 subgoals):
 1. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.Untyped\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P1.3615 deviceMemory userSizea apiType) (?P1'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P2.3615 deviceMemory userSizea apiType) (?P2'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> ?P1.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> ?P2.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> ?P1'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> ?P2'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 8. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 9. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (9 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P1.3615 deviceMemory userSizea ArchTypes_H.apiobject_type.Untyped) (?P1'3615 deviceMemory userSizea ArchTypes_H.apiobject_type.Untyped) [SKIP] (return (capability.UntypedCap (to_bool deviceMemory) regionBase (unat userSizea) 0)) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P2.3615 deviceMemory userSizea apiType) (?P2'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> ?P1.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> ?P2.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> ?P1'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> ?P2'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 8. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 9. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (11 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q3666 deviceMemory userSizea) (?Q'3666 deviceMemory userSizea) [SKIP] (return (capability.UntypedCap (to_bool deviceMemory) regionBase (unat userSizea) 0)) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemory userSizea s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat userSizea) isdev s\<rbrakk> \<Longrightarrow> ?Q3666 deviceMemory userSizea s
 3. \<And>deviceMemory userSizea s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Q'3666 deviceMemory userSizea
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P2.3615 deviceMemory userSizea apiType) (?P2'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> ?P2.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 9. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> ?P2'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 10. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q3666 deviceMemory userSizea) (?Q'3670 deviceMemory userSizea) [SKIP] (return (capability.UntypedCap (to_bool deviceMemory) regionBase (unat userSizea) 0)) (return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3666 deviceMemory userSizea) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase) (?Q'3670 deviceMemory userSizea)
 3. \<And>deviceMemory userSizea s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; ?Q3666 deviceMemory userSizea s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3666 deviceMemory userSizea \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase) {s'. (s, s') \<in> rf_sr}
 4. \<And>deviceMemory userSizea s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat userSizea) isdev s\<rbrakk> \<Longrightarrow> ?Q3666 deviceMemory userSizea s
 5. \<And>deviceMemory userSizea s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Q'3666 deviceMemory userSizea
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P2.3615 deviceMemory userSizea apiType) (?P2'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 8. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 9. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 10. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> ?P2.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3666 deviceMemory userSizea) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase) \<lbrace>ccap_relation (capability.UntypedCap (to_bool deviceMemory) regionBase (unat userSizea) 0) \<acute>ret__struct_cap_C\<rbrace>
 2. \<And>deviceMemory userSizea s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3666 deviceMemory userSizea \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase) {s'. (s, s') \<in> rf_sr}
 3. \<And>deviceMemory userSizea s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat userSizea) isdev s\<rbrakk> \<Longrightarrow> True
 4. \<And>deviceMemory userSizea s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Q'3666 deviceMemory userSizea
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P2.3615 deviceMemory userSizea apiType) (?P2'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 8. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 9. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> ?P2.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 10. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> ?P2'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>deviceMemory userSizea s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<forall>t. cap_untyped_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = \<lparr>capFreeIndex_CL = 0 && mask 26, capIsDevice_CL = (if deviceMemory \<noteq> 0 then 1 else 0) && mask 1, capBlockSize_CL = userSizea && mask 5, capPtr_CL = regionBase && ~~ mask 4\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> ccap_relation (capability.UntypedCap (to_bool deviceMemory) regionBase (unat userSizea) 0) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase) {s'. (s, s') \<in> rf_sr}
 2. \<And>deviceMemory userSizea s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat userSizea) isdev s\<rbrakk> \<Longrightarrow> True
 3. \<And>deviceMemory userSizea s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>\<forall>t. cap_untyped_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = \<lparr>capFreeIndex_CL = 0 && mask 26, capIsDevice_CL = (if deviceMemory \<noteq> 0 then 1 else 0) && mask 1, capBlockSize_CL = userSizea && mask 5, capPtr_CL = regionBase && ~~ mask 4\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> ccap_relation (capability.UntypedCap (to_bool deviceMemory) regionBase (unat userSizea) 0) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P2.3615 deviceMemory userSizea apiType) (?P2'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> ?P2.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 9. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> ?P2'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 10. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>deviceMemory userSizea s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat userSizea) isdev s\<rbrakk> \<Longrightarrow> True
 2. \<And>deviceMemory userSizea s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>\<forall>t. cap_untyped_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = \<lparr>capFreeIndex_CL = 0 && mask 26, capIsDevice_CL = (if deviceMemory \<noteq> 0 then 1 else 0) && mask 1, capBlockSize_CL = userSizea && mask 5, capPtr_CL = regionBase && ~~ mask 4\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> ccap_relation (capability.UntypedCap (to_bool deviceMemory) regionBase (unat userSizea) 0) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P2.3615 deviceMemory userSizea apiType) (?P2'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> ?P2.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> ?P2'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 9. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 10. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (9 subgoals):
 1. \<And>deviceMemory userSizea s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>\<forall>t. cap_untyped_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = \<lparr>capFreeIndex_CL = 0 && mask 26, capIsDevice_CL = (if deviceMemory \<noteq> 0 then 1 else 0) && mask 1, capBlockSize_CL = userSizea && mask 5, capPtr_CL = regionBase && ~~ mask 4\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> ccap_relation (capability.UntypedCap (to_bool deviceMemory) regionBase (unat userSizea) 0) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P2.3615 deviceMemory userSizea apiType) (?P2'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> ?P2.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> ?P2'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 8. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 9. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (9 subgoals):
 1. \<And>deviceMemory userSizea t. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; cap_untyped_cap_lift (ret__struct_cap_C_' t) = \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = (if deviceMemory \<noteq> 0 then 1 else 0) && 1, capBlockSize_CL = userSizea && mask 5, capPtr_CL = regionBase && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = (if deviceMemory \<noteq> 0 then 1 else 0) && 1, capBlockSize_CL = userSizea && mask 5, capPtr_CL = regionBase && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> to_bool deviceMemory = to_bool ((if deviceMemory \<noteq> 0 then 1 else 0) && 1) \<and> regionBase = regionBase && ~~ mask 4 \<and> userSizea = userSizea && mask 5
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P2.3615 deviceMemory userSizea apiType) (?P2'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> ?P2.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> ?P2'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 8. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 9. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (11 subgoals):
 1. \<And>deviceMemory userSizea t. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; cap_untyped_cap_lift (ret__struct_cap_C_' t) = \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = (if deviceMemory \<noteq> 0 then 1 else 0) && 1, capBlockSize_CL = userSizea && mask 5, capPtr_CL = regionBase && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = (if deviceMemory \<noteq> 0 then 1 else 0) && 1, capBlockSize_CL = userSizea && mask 5, capPtr_CL = regionBase && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> is_aligned regionBase (?x3722 deviceMemory userSizea t)
 2. \<And>deviceMemory userSizea t. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; cap_untyped_cap_lift (ret__struct_cap_C_' t) = \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = (if deviceMemory \<noteq> 0 then 1 else 0) && 1, capBlockSize_CL = userSizea && mask 5, capPtr_CL = regionBase && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = (if deviceMemory \<noteq> 0 then 1 else 0) && 1, capBlockSize_CL = userSizea && mask 5, capPtr_CL = regionBase && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> 4 \<le> ?x3722 deviceMemory userSizea t
 3. \<And>deviceMemory userSizea t. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; cap_untyped_cap_lift (ret__struct_cap_C_' t) = \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = (if deviceMemory \<noteq> 0 then 1 else 0) && 1, capBlockSize_CL = userSizea && mask 5, capPtr_CL = regionBase && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = (if deviceMemory \<noteq> 0 then 1 else 0) && 1, capBlockSize_CL = userSizea && mask 5, capPtr_CL = regionBase && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> to_bool deviceMemory = to_bool ((if deviceMemory \<noteq> 0 then 1 else 0) && 1) \<and> regionBase = regionBase \<and> userSizea = userSizea && mask 5
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P2.3615 deviceMemory userSizea apiType) (?P2'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> ?P2.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 9. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> ?P2'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 10. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>deviceMemory userSizea t. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; cap_untyped_cap_lift (ret__struct_cap_C_' t) = \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = (if deviceMemory \<noteq> 0 then 1 else 0) && 1, capBlockSize_CL = userSizea && mask 5, capPtr_CL = regionBase && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = (if deviceMemory \<noteq> 0 then 1 else 0) && 1, capBlockSize_CL = userSizea && mask 5, capPtr_CL = regionBase && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> 4 \<le> unat userSizea
 2. \<And>deviceMemory userSizea t. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; cap_untyped_cap_lift (ret__struct_cap_C_' t) = \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = (if deviceMemory \<noteq> 0 then 1 else 0) && 1, capBlockSize_CL = userSizea && mask 5, capPtr_CL = regionBase && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = (if deviceMemory \<noteq> 0 then 1 else 0) && 1, capBlockSize_CL = userSizea && mask 5, capPtr_CL = regionBase && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> to_bool deviceMemory = to_bool ((if deviceMemory \<noteq> 0 then 1 else 0) && 1) \<and> regionBase = regionBase \<and> userSizea = userSizea && mask 5
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P2.3615 deviceMemory userSizea apiType) (?P2'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> ?P2.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> ?P2'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 9. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 10. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (9 subgoals):
 1. \<And>deviceMemory userSizea t. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; cap_untyped_cap_lift (ret__struct_cap_C_' t) = \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = (if deviceMemory \<noteq> 0 then 1 else 0) && 1, capBlockSize_CL = userSizea && mask 5, capPtr_CL = regionBase && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = (if deviceMemory \<noteq> 0 then 1 else 0) && 1, capBlockSize_CL = userSizea && mask 5, capPtr_CL = regionBase && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> to_bool deviceMemory = to_bool ((if deviceMemory \<noteq> 0 then 1 else 0) && 1) \<and> regionBase = regionBase \<and> userSizea = userSizea && mask 5
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P2.3615 deviceMemory userSizea apiType) (?P2'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> ?P2.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> ?P2'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 8. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 9. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (9 subgoals):
 1. \<And>deviceMemory userSizea t. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped; regionBase \<noteq> 0; {regionBase..+2 ^ unat userSizea} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea) (unat userSizea) (Suc 0); unat userSizea \<le> maxUntypedSizeBits; minUntypedSizeBits \<le> unat userSizea; cap_lift (ret__struct_cap_C_' t) = Some (Cap_untyped_cap \<lparr>capFreeIndex_CL = 0, capIsDevice_CL = (if deviceMemory \<noteq> 0 then 1 else 0) && 1, capBlockSize_CL = userSizea && mask 5, capPtr_CL = regionBase && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> to_bool deviceMemory = to_bool ((if deviceMemory \<noteq> 0 then 1 else 0) && 1) \<and> userSizea = userSizea && mask 5
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P2.3615 deviceMemory userSizea apiType) (?P2'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> ?P2.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> ?P2'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 8. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 9. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P2.3615 deviceMemory userSizea apiType) (?P2'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> ?P2.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> ?P2'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.TCBObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P2.3615 deviceMemory userSizea apiType) (?P2'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> ?P2.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> ?P2'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P2.3615 deviceMemory userSizea ArchTypes_H.apiobject_type.TCBObject) (?P2'3615 deviceMemory userSizea ArchTypes_H.apiobject_type.TCBObject) [SKIP] (do y <- placeNewObject regionBase makeObject 0;
curdom <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. curdom)) regionBase;
return (capability.ThreadCap regionBase)
od) (lvar_nondet_init tcb_' tcb_'_update;;
(\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
(\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')))))))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> ?P2.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> ?P2'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (9 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q3940 deviceMemory userSizea) (?Q'3940 deviceMemory userSizea) [SKIP] (do y <- placeNewObject regionBase makeObject 0;
curdom <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. curdom)) regionBase;
return (capability.ThreadCap regionBase)
od) (lvar_nondet_init tcb_' tcb_'_update;;
(\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
(\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')))))))
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> ?Q3940 deviceMemory userSizea s \<and> s' \<in> ?Q'3940 deviceMemory userSizea
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 8. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 9. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (11 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q3940 deviceMemory userSizea) (?Q'3941 deviceMemory userSizea) [SKIP] (do y <- placeNewObject regionBase makeObject 0;
curdom <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. curdom)) regionBase;
return (capability.ThreadCap regionBase)
od) (\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
(\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'))))))
 2. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea) lvar_nondet_init tcb_' tcb_'_update (?Q'3941 deviceMemory userSizea)
 3. \<And>deviceMemory userSizea s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); ?Q3940 deviceMemory userSizea s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea \<inter> {s'. (s, s') \<in> rf_sr}) lvar_nondet_init tcb_' tcb_'_update {s'. (s, s') \<in> rf_sr}
 4. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> ?Q3940 deviceMemory userSizea s \<and> s' \<in> ?Q'3940 deviceMemory userSizea
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 9. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 10. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>deviceMemory userSizea rv'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q3940 deviceMemory userSizea) (?G'3945 deviceMemory userSizea rv') [SKIP] (do y <- placeNewObject regionBase makeObject 0;
curdom <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. curdom)) regionBase;
return (capability.ThreadCap regionBase)
od) (\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
(\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'))))))
 2. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea) lvar_nondet_init tcb_' tcb_'_update {s. s \<in> ?G'3945 deviceMemory userSizea ()}
 3. \<And>deviceMemory userSizea s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); ?Q3940 deviceMemory userSizea s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea \<inter> {s'. (s, s') \<in> rf_sr}) lvar_nondet_init tcb_' tcb_'_update {s'. (s, s') \<in> rf_sr}
 4. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> ?Q3940 deviceMemory userSizea s \<and> s' \<in> ?Q'3940 deviceMemory userSizea
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 9. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 10. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q3940 deviceMemory userSizea) (?G'3945 deviceMemory userSizea ()) [SKIP] (do y <- placeNewObject regionBase makeObject 0;
curdom <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. curdom)) regionBase;
return (capability.ThreadCap regionBase)
od) (\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
(Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) (ptr_retyp \<acute>tcb (hrs_htd \<acute>t_hrs)))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
(\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'))))))
 2. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea) lvar_nondet_init tcb_' tcb_'_update {s. s \<in> ?G'3945 deviceMemory userSizea ()}
 3. \<And>deviceMemory userSizea s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); ?Q3940 deviceMemory userSizea s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea \<inter> {s'. (s, s') \<in> rf_sr}) lvar_nondet_init tcb_' tcb_'_update {s'. (s, s') \<in> rf_sr}
 4. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> ?Q3940 deviceMemory userSizea s \<and> s' \<in> ?Q'3940 deviceMemory userSizea
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 9. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 10. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>deviceMemory userSizea rv xfdc. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q3999 deviceMemory userSizea rv) (?Q'3999 deviceMemory userSizea rv xfdc) [SKIP] (do curdom <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. curdom)) regionBase;
return (capability.ThreadCap regionBase)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
(\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'))
 2. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R3999 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>?Q3999 deviceMemory userSizea\<rbrace>
 3. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4000 deviceMemory userSizea ()) \<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) (ptr_retyp \<acute>tcb (hrs_htd \<acute>t_hrs)))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'3999 deviceMemory userSizea rv (xfdc s)}
 4. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea) lvar_nondet_init tcb_' tcb_'_update {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0} \<inter> ?R'4000 deviceMemory userSizea ()}
 5. \<And>deviceMemory userSizea s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea \<inter> {s'. (s, s') \<in> rf_sr}) lvar_nondet_init tcb_' tcb_'_update {s'. (s, s') \<in> rf_sr}
 6. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s \<and> s' \<in> ?Q'3940 deviceMemory userSizea
 7. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 8. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 9. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 10. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>deviceMemory userSizea xfdc. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q3999 deviceMemory userSizea ()) (?Q'3999 deviceMemory userSizea () xfdc) [SKIP] (do curdom <- curDomain;
y <- threadSet (tcbDomain_update (\<lambda>_. curdom)) regionBase;
return (capability.ThreadCap regionBase)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
(\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'))
 2. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R3999 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>?Q3999 deviceMemory userSizea\<rbrace>
 3. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4000 deviceMemory userSizea ()) \<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) (ptr_retyp \<acute>tcb (hrs_htd \<acute>t_hrs)))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'3999 deviceMemory userSizea rv (xfdc s)}
 4. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea) lvar_nondet_init tcb_' tcb_'_update {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0} \<inter> ?R'4000 deviceMemory userSizea ()}
 5. \<And>deviceMemory userSizea s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea \<inter> {s'. (s, s') \<in> rf_sr}) lvar_nondet_init tcb_' tcb_'_update {s'. (s, s') \<in> rf_sr}
 6. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s \<and> s' \<in> ?Q'3940 deviceMemory userSizea
 7. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 8. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 9. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 10. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>deviceMemory userSizea xfdc curdom. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. ?P4034 deviceMemory userSizea () a curdom) (?P'4035 deviceMemory userSizea () xfdc curdom) [SKIP] (do y <- threadSet (tcbDomain_update (\<lambda>_. curdom)) regionBase;
return (capability.ThreadCap regionBase)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
(\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'))
 2. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R3999 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> ?P4034 deviceMemory userSizea a b rv\<rbrace>
 3. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4000 deviceMemory userSizea ()) \<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) (ptr_retyp \<acute>tcb (hrs_htd \<acute>t_hrs)))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> ?P'4035 deviceMemory userSizea rv (xfdc s) rva}}
 4. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea) lvar_nondet_init tcb_' tcb_'_update {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0} \<inter> ?R'4000 deviceMemory userSizea ()}
 5. \<And>deviceMemory userSizea s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea \<inter> {s'. (s, s') \<in> rf_sr}) lvar_nondet_init tcb_' tcb_'_update {s'. (s, s') \<in> rf_sr}
 6. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s \<and> s' \<in> ?Q'3940 deviceMemory userSizea
 7. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 8. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 9. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 10. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>deviceMemory userSizea xfdca curdom rv xfdc. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q4045 deviceMemory userSizea xfdca curdom rv) (?Q'4045 deviceMemory userSizea xfdca curdom rv xfdc) [SKIP] (return (capability.ThreadCap regionBase)) (\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemory userSizea xfdc curdom. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4050 deviceMemory userSizea () curdom\<rbrace> threadSet (tcbDomain_update (\<lambda>_. curdom)) regionBase \<lbrace>?Q4045 deviceMemory userSizea xfdc curdom\<rbrace>
 3. \<And>deviceMemory userSizea xfdca curdom. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4046 deviceMemory userSizea () xfdca curdom) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4045 deviceMemory userSizea xfdca curdom rv (xfdc s)}
 4. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R3999 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> (tcb_at' regionBase and ?R4050 deviceMemory userSizea a rv) b\<rbrace>
 5. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4000 deviceMemory userSizea ()) \<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) (ptr_retyp \<acute>tcb (hrs_htd \<acute>t_hrs)))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr regionBase \<and> \<acute>ksCurDomain = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> ?R'4046 deviceMemory userSizea rv (xfdc s) rva \<inter> {s. s \<Turnstile>\<^sub>c tcb_' s}}}
 6. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea) lvar_nondet_init tcb_' tcb_'_update {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0} \<inter> ?R'4000 deviceMemory userSizea ()}
 7. \<And>deviceMemory userSizea s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea \<inter> {s'. (s, s') \<in> rf_sr}) lvar_nondet_init tcb_' tcb_'_update {s'. (s, s') \<in> rf_sr}
 8. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s \<and> s' \<in> ?Q'3940 deviceMemory userSizea
 9. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 10. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>deviceMemory userSizea xfdca curdom rv xfdc. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q4045 deviceMemory userSizea xfdca curdom rv) (?Q'4079 deviceMemory userSizea xfdca curdom rv xfdc) [SKIP] (return (capability.ThreadCap regionBase)) (return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemory userSizea xfdca curdom rv xfdc. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4045 deviceMemory userSizea xfdca curdom rv xfdc) \<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb) (?Q'4079 deviceMemory userSizea xfdca curdom rv xfdc)
 3. \<And>deviceMemory userSizea xfdca curdom rv xfdc s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); dc rv xfdc; ?Q4045 deviceMemory userSizea xfdca curdom rv s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4045 deviceMemory userSizea xfdca curdom rv xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb) {s'. (s, s') \<in> rf_sr}
 4. \<And>deviceMemory userSizea xfdc curdom. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4050 deviceMemory userSizea () curdom\<rbrace> threadSet (tcbDomain_update (\<lambda>_. curdom)) regionBase \<lbrace>?Q4045 deviceMemory userSizea xfdc curdom\<rbrace>
 5. \<And>deviceMemory userSizea xfdca curdom. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4046 deviceMemory userSizea () xfdca curdom) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4045 deviceMemory userSizea xfdca curdom rv (xfdc s)}
 6. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R3999 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> (tcb_at' regionBase and ?R4050 deviceMemory userSizea a rv) b\<rbrace>
 7. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4000 deviceMemory userSizea ()) \<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) (ptr_retyp \<acute>tcb (hrs_htd \<acute>t_hrs)))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr regionBase \<and> \<acute>ksCurDomain = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> ?R'4046 deviceMemory userSizea rv (xfdc s) rva \<inter> {s. s \<Turnstile>\<^sub>c tcb_' s}}}
 8. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea) lvar_nondet_init tcb_' tcb_'_update {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0} \<inter> ?R'4000 deviceMemory userSizea ()}
 9. \<And>deviceMemory userSizea s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea \<inter> {s'. (s, s') \<in> rf_sr}) lvar_nondet_init tcb_' tcb_'_update {s'. (s, s') \<in> rf_sr}
 10. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s \<and> s' \<in> ?Q'3940 deviceMemory userSizea
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>deviceMemory userSizea xfdca curdom rv xfdc. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4045 deviceMemory userSizea xfdca curdom rv xfdc) \<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb) \<lbrace>ccap_relation (capability.ThreadCap regionBase) \<acute>ret__struct_cap_C\<rbrace>
 2. \<And>deviceMemory userSizea xfdca curdom rv xfdc s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); dc rv xfdc; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4045 deviceMemory userSizea xfdca curdom rv xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb) {s'. (s, s') \<in> rf_sr}
 3. \<And>deviceMemory userSizea xfdc curdom. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4050 deviceMemory userSizea () curdom\<rbrace> threadSet (tcbDomain_update (\<lambda>_. curdom)) regionBase \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>deviceMemory userSizea xfdca curdom. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4046 deviceMemory userSizea () xfdca curdom) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4045 deviceMemory userSizea xfdca curdom rv (xfdc s)}
 5. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R3999 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> (tcb_at' regionBase and ?R4050 deviceMemory userSizea a rv) b\<rbrace>
 6. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4000 deviceMemory userSizea ()) \<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) (ptr_retyp \<acute>tcb (hrs_htd \<acute>t_hrs)))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr regionBase \<and> \<acute>ksCurDomain = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> ?R'4046 deviceMemory userSizea rv (xfdc s) rva \<inter> {s. s \<Turnstile>\<^sub>c tcb_' s}}}
 7. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea) lvar_nondet_init tcb_' tcb_'_update {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0} \<inter> ?R'4000 deviceMemory userSizea ()}
 8. \<And>deviceMemory userSizea s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea \<inter> {s'. (s, s') \<in> rf_sr}) lvar_nondet_init tcb_' tcb_'_update {s'. (s, s') \<in> rf_sr}
 9. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s \<and> s' \<in> ?Q'3940 deviceMemory userSizea
 10. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>deviceMemory userSizea xfdca curdom rv xfdc s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); dc rv xfdc; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<forall>t. cap_thread_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = ptr_val \<acute>tcb && ~~ mask 4\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb) {s'. (s, s') \<in> rf_sr}
 2. \<And>deviceMemory userSizea xfdc curdom. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4050 deviceMemory userSizea () curdom\<rbrace> threadSet (tcbDomain_update (\<lambda>_. curdom)) regionBase \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>deviceMemory userSizea xfdca curdom. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4046 deviceMemory userSizea () xfdca curdom) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> \<lbrace>\<forall>t. cap_thread_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = ptr_val \<acute>tcb && ~~ mask 4\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>}
 4. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R3999 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> (tcb_at' regionBase and ?R4050 deviceMemory userSizea a rv) b\<rbrace>
 5. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4000 deviceMemory userSizea ()) \<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) (ptr_retyp \<acute>tcb (hrs_htd \<acute>t_hrs)))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr regionBase \<and> \<acute>ksCurDomain = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> ?R'4046 deviceMemory userSizea rv (xfdc s) rva \<inter> {s. s \<Turnstile>\<^sub>c tcb_' s}}}
 6. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea) lvar_nondet_init tcb_' tcb_'_update {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0} \<inter> ?R'4000 deviceMemory userSizea ()}
 7. \<And>deviceMemory userSizea s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea \<inter> {s'. (s, s') \<in> rf_sr}) lvar_nondet_init tcb_' tcb_'_update {s'. (s, s') \<in> rf_sr}
 8. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s \<and> s' \<in> ?Q'3940 deviceMemory userSizea
 9. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 10. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>deviceMemory userSizea xfdc curdom. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4050 deviceMemory userSizea () curdom\<rbrace> threadSet (tcbDomain_update (\<lambda>_. curdom)) regionBase \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>deviceMemory userSizea xfdca curdom. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4046 deviceMemory userSizea () xfdca curdom) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> \<lbrace>\<forall>t. cap_thread_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = ptr_val \<acute>tcb && ~~ mask 4\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>}
 3. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R3999 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> (tcb_at' regionBase and ?R4050 deviceMemory userSizea a rv) b\<rbrace>
 4. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4000 deviceMemory userSizea ()) \<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) (ptr_retyp \<acute>tcb (hrs_htd \<acute>t_hrs)))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr regionBase \<and> \<acute>ksCurDomain = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> ?R'4046 deviceMemory userSizea rv (xfdc s) rva \<inter> {s. s \<Turnstile>\<^sub>c tcb_' s}}}
 5. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea) lvar_nondet_init tcb_' tcb_'_update {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0} \<inter> ?R'4000 deviceMemory userSizea ()}
 6. \<And>deviceMemory userSizea s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea \<inter> {s'. (s, s') \<in> rf_sr}) lvar_nondet_init tcb_' tcb_'_update {s'. (s, s') \<in> rf_sr}
 7. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s \<and> s' \<in> ?Q'3940 deviceMemory userSizea
 8. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 9. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 10. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>deviceMemory userSizea xfdca curdom. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4046 deviceMemory userSizea () xfdca curdom) \<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> \<lbrace>\<forall>t. cap_thread_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = ptr_val \<acute>tcb && ~~ mask 4\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>}
 2. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R3999 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> (tcb_at' regionBase and (\<lambda>a. True)) b\<rbrace>
 3. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4000 deviceMemory userSizea ()) \<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) (ptr_retyp \<acute>tcb (hrs_htd \<acute>t_hrs)))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rva. ksCurDomain_' (globals sa) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> sa \<in> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr regionBase \<and> \<acute>ksCurDomain = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> ?R'4046 deviceMemory userSizea rv (xfdc s) rva \<inter> {s. s \<Turnstile>\<^sub>c tcb_' s}}}
 4. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea) lvar_nondet_init tcb_' tcb_'_update {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0} \<inter> ?R'4000 deviceMemory userSizea ()}
 5. \<And>deviceMemory userSizea s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea \<inter> {s'. (s, s') \<in> rf_sr}) lvar_nondet_init tcb_' tcb_'_update {s'. (s, s') \<in> rf_sr}
 6. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s \<and> s' \<in> ?Q'3940 deviceMemory userSizea
 7. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 8. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 9. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 10. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R3999 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>\<lambda>a b. \<forall>rv. ksCurDomain b = rv \<longrightarrow> (tcb_at' regionBase and (\<lambda>a. True)) b\<rbrace>
 2. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4000 deviceMemory userSizea ()) \<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) (ptr_retyp \<acute>tcb (hrs_htd \<acute>t_hrs)))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>rva. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr regionBase \<and> \<acute>ksCurDomain = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> {s. \<forall>rva. dc rva (xfdc (globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(tcb_' s\<rightarrow>[''tcbDomain_C''])) (ksCurDomain_' (globals s))))) s)) \<longrightarrow> (\<forall>t. cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = ptr_val (tcb_' s) && ~~ mask 4, \<dots> = rv\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) (ret__struct_cap_C_' t))} \<inter> {s. s \<Turnstile>\<^sub>c tcb_' s}}}
 3. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea) lvar_nondet_init tcb_' tcb_'_update {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0} \<inter> ?R'4000 deviceMemory userSizea ()}
 4. \<And>deviceMemory userSizea s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea \<inter> {s'. (s, s') \<in> rf_sr}) lvar_nondet_init tcb_' tcb_'_update {s'. (s, s') \<in> rf_sr}
 5. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s \<and> s' \<in> ?Q'3940 deviceMemory userSizea
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 8. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 9. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 10. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R3999 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>\<lambda>a. ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj) regionBase\<rbrace>
 2. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4000 deviceMemory userSizea ()) \<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) (ptr_retyp \<acute>tcb (hrs_htd \<acute>t_hrs)))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>rva. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr regionBase \<and> \<acute>ksCurDomain = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> {s. \<forall>rva. dc rva (xfdc (globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(tcb_' s\<rightarrow>[''tcbDomain_C''])) (ksCurDomain_' (globals s))))) s)) \<longrightarrow> (\<forall>t. cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = ptr_val (tcb_' s) && ~~ mask 4, \<dots> = rv\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) (ret__struct_cap_C_' t))} \<inter> {s. s \<Turnstile>\<^sub>c tcb_' s}}}
 3. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea) lvar_nondet_init tcb_' tcb_'_update {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0} \<inter> ?R'4000 deviceMemory userSizea ()}
 4. \<And>deviceMemory userSizea s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea \<inter> {s'. (s, s') \<in> rf_sr}) lvar_nondet_init tcb_' tcb_'_update {s'. (s, s') \<in> rf_sr}
 5. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and ?R3999 deviceMemory userSizea) s \<and> s' \<in> ?Q'3940 deviceMemory userSizea
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 8. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 9. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 10. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4000 deviceMemory userSizea ()) \<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) (ptr_retyp \<acute>tcb (hrs_htd \<acute>t_hrs)))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>rva. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> s \<in> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr regionBase \<and> \<acute>ksCurDomain = UCAST(8 \<rightarrow> 32) rva\<rbrace> \<inter> {s. \<forall>rva. dc rva (xfdc (globals_update (t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(tcb_' s\<rightarrow>[''tcbDomain_C''])) (ksCurDomain_' (globals s))))) s)) \<longrightarrow> (\<forall>t. cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = ptr_val (tcb_' s) && ~~ mask 4, \<dots> = rv\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) (ret__struct_cap_C_' t))} \<inter> {s. s \<Turnstile>\<^sub>c tcb_' s}}}
 2. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea) lvar_nondet_init tcb_' tcb_'_update {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0} \<inter> ?R'4000 deviceMemory userSizea ()}
 3. \<And>deviceMemory userSizea s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and (\<lambda>s. (if regionBase \<in> set (new_cap_addrs (2 ^ 0) regionBase (injectKOS makeObject)) then \<exists>obj. projectKO_opt (injectKOS makeObject) = Some obj else ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj) regionBase s) \<and> objBitsKO (injectKOS makeObject) + 0 < word_bits \<and> is_aligned regionBase (objBitsKO (injectKOS makeObject) + 0) \<and> pspace_no_overlap' regionBase (objBitsKO (injectKOS makeObject) + 0) s \<and> pspace_aligned' s \<and> pspace_distinct' s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea \<inter> {s'. (s, s') \<in> rf_sr}) lvar_nondet_init tcb_' tcb_'_update {s'. (s, s') \<in> rf_sr}
 4. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and (\<lambda>s. (if regionBase \<in> set (new_cap_addrs (2 ^ 0) regionBase (injectKOS makeObject)) then \<exists>obj. projectKO_opt (injectKOS makeObject) = Some obj else ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj) regionBase s) \<and> objBitsKO (injectKOS makeObject) + 0 < word_bits \<and> is_aligned regionBase (objBitsKO (injectKOS makeObject) + 0) \<and> pspace_no_overlap' regionBase (objBitsKO (injectKOS makeObject) + 0) s \<and> pspace_aligned' s \<and> pspace_distinct' s)) s \<and> s' \<in> ?Q'3940 deviceMemory userSizea
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 9. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 10. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea) lvar_nondet_init tcb_' tcb_'_update {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0} \<inter> {s. htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (ptr_val (tcb_Ptr (regionBase + 0x100)) - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s))))) \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (ptr_val (tcb_Ptr (regionBase + 0x100)) - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<longrightarrow> Kernel_C.CPSR <s 0x14 \<longrightarrow> 0 \<le>s Kernel_C.CPSR \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (ptr_val (tcb_Ptr (regionBase + 0x100)) - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<longrightarrow> 0 \<le>s 8 \<longrightarrow> unat 1 * 2 ^ unat 8 < 2 ^ 31 \<and> 0 \<le>s 1 \<longrightarrow> 0 \<le>s 6 \<longrightarrow> unat 1 * 2 ^ unat 6 < 2 ^ 31 \<longrightarrow> hrs_htd (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (ptr_val (tcb_Ptr (regionBase + 0x100)) - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s)))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) (SCAST(32 signed \<rightarrow> 32) (((1 << unat 6) || 0x10) || (1 << unat 8))))) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (ptr_val (tcb_Ptr (regionBase + 0x100)) - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s)))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (ptr_val (tcb_Ptr (regionBase + 0x100)) - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s)))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) (SCAST(32 signed \<rightarrow> 32) (((1 << unat 6) || 0x10) || (1 << unat 8))))) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (ptr_val (tcb_Ptr (regionBase + 0x100)) - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) x))) (globals s)\<rparr>)) \<longrightarrow> (\<forall>rva. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rva \<longrightarrow> tcb_Ptr (regionBase + 0x100) = tcb_ptr_to_ctcb_ptr regionBase \<and> (\<forall>rvb. dc rvb (xfdc (s\<lparr>tcb_' := tcb_Ptr (regionBase + 0x100), globals := t_hrs_'_update (\<lambda>x. hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbDomain_C''])) (UCAST(8 \<rightarrow> 32) rva)) (hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (ptr_val (tcb_Ptr (regionBase + 0x100)) - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s)))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) (SCAST(32 signed \<rightarrow> 32) (((1 << unat 6) || 0x10) || (1 << unat 8))))) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (ptr_val (tcb_Ptr (regionBase + 0x100)) - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) x)))) (globals s)\<rparr>)) \<longrightarrow> (\<forall>t. cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = ptr_val (tcb_Ptr (regionBase + 0x100)) && ~~ mask 4, \<dots> = rv\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) (ret__struct_cap_C_' t))) \<and> hrs_htd (hrs_mem_update (heap_update (PTR(32 word) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbTimeSlice_C''])) 5) (hrs_mem_update (heap_update (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])) (Arrays.update (h_val (hrs_mem (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (ptr_val (tcb_Ptr (regionBase + 0x100)) - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s)))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C'']))) (unat Kernel_C.CPSR) (SCAST(32 signed \<rightarrow> 32) (((1 << unat 6) || 0x10) || (1 << unat 8))))) (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (ptr_val (tcb_Ptr (regionBase + 0x100)) - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s))))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100)))}}
 2. \<And>deviceMemory userSizea s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and (\<lambda>s. (if regionBase \<in> set (new_cap_addrs (2 ^ 0) regionBase (injectKOS makeObject)) then \<exists>obj. projectKO_opt (injectKOS makeObject) = Some obj else ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj) regionBase s) \<and> objBitsKO (injectKOS makeObject) + 0 < word_bits \<and> is_aligned regionBase (objBitsKO (injectKOS makeObject) + 0) \<and> pspace_no_overlap' regionBase (objBitsKO (injectKOS makeObject) + 0) s \<and> pspace_aligned' s \<and> pspace_distinct' s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea \<inter> {s'. (s, s') \<in> rf_sr}) lvar_nondet_init tcb_' tcb_'_update {s'. (s, s') \<in> rf_sr}
 3. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and (\<lambda>s. (if regionBase \<in> set (new_cap_addrs (2 ^ 0) regionBase (injectKOS makeObject)) then \<exists>obj. projectKO_opt (injectKOS makeObject) = Some obj else ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj) regionBase s) \<and> objBitsKO (injectKOS makeObject) + 0 < word_bits \<and> is_aligned regionBase (objBitsKO (injectKOS makeObject) + 0) \<and> pspace_no_overlap' regionBase (objBitsKO (injectKOS makeObject) + 0) s \<and> pspace_aligned' s \<and> pspace_distinct' s)) s \<and> s' \<in> ?Q'3940 deviceMemory userSizea
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 9. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 10. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (10 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea) lvar_nondet_init tcb_' tcb_'_update {s. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s))))) \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<longrightarrow> Kernel_C.CPSR <s 0x14 \<longrightarrow> 0 \<le>s Kernel_C.CPSR \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> tcb_Ptr (regionBase + 0x100) = tcb_ptr_to_ctcb_ptr regionBase \<and> (\<forall>t. cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) (ret__struct_cap_C_' t)))}
 2. \<And>deviceMemory userSizea s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and (\<lambda>s. (if regionBase \<in> set (new_cap_addrs (2 ^ 0) regionBase (injectKOS makeObject)) then \<exists>obj. projectKO_opt (injectKOS makeObject) = Some obj else ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj) regionBase s) \<and> objBitsKO (injectKOS makeObject) + 0 < word_bits \<and> is_aligned regionBase (objBitsKO (injectKOS makeObject) + 0) \<and> pspace_no_overlap' regionBase (objBitsKO (injectKOS makeObject) + 0) s \<and> pspace_aligned' s \<and> pspace_distinct' s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3940 deviceMemory userSizea \<inter> {s'. (s, s') \<in> rf_sr}) lvar_nondet_init tcb_' tcb_'_update {s'. (s, s') \<in> rf_sr}
 3. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and (\<lambda>s. (if regionBase \<in> set (new_cap_addrs (2 ^ 0) regionBase (injectKOS makeObject)) then \<exists>obj. projectKO_opt (injectKOS makeObject) = Some obj else ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj) regionBase s) \<and> objBitsKO (injectKOS makeObject) + 0 < word_bits \<and> is_aligned regionBase (objBitsKO (injectKOS makeObject) + 0) \<and> pspace_no_overlap' regionBase (objBitsKO (injectKOS makeObject) + 0) s \<and> pspace_aligned' s \<and> pspace_distinct' s)) s \<and> s' \<in> ?Q'3940 deviceMemory userSizea
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 9. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 10. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (9 subgoals):
 1. \<And>deviceMemory userSizea s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and (\<lambda>s. (if regionBase \<in> set (new_cap_addrs (2 ^ 0) regionBase (injectKOS makeObject)) then \<exists>obj. projectKO_opt (injectKOS makeObject) = Some obj else ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj) regionBase s) \<and> objBitsKO (injectKOS makeObject) + 0 < word_bits \<and> is_aligned regionBase (objBitsKO (injectKOS makeObject) + 0) \<and> pspace_no_overlap' regionBase (objBitsKO (injectKOS makeObject) + 0) s \<and> pspace_aligned' s \<and> pspace_distinct' s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. \<forall>v. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s))))) \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<longrightarrow> Kernel_C.CPSR <s 0x14 \<longrightarrow> 0 \<le>s Kernel_C.CPSR \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> tcb_Ptr (regionBase + 0x100) = tcb_ptr_to_ctcb_ptr regionBase \<and> (\<forall>t. cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) (ret__struct_cap_C_' t)))} \<inter> {s'. (s, s') \<in> rf_sr}) lvar_nondet_init tcb_' tcb_'_update {s'. (s, s') \<in> rf_sr}
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and (\<lambda>s. (if regionBase \<in> set (new_cap_addrs (2 ^ 0) regionBase (injectKOS makeObject)) then \<exists>obj. projectKO_opt (injectKOS makeObject) = Some obj else ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj) regionBase s) \<and> objBitsKO (injectKOS makeObject) + 0 < word_bits \<and> is_aligned regionBase (objBitsKO (injectKOS makeObject) + 0) \<and> pspace_no_overlap' regionBase (objBitsKO (injectKOS makeObject) + 0) s \<and> pspace_aligned' s \<and> pspace_distinct' s)) s \<and> s' \<in> {s. \<forall>v. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s))))) \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<longrightarrow> Kernel_C.CPSR <s 0x14 \<longrightarrow> 0 \<le>s Kernel_C.CPSR \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> tcb_Ptr (regionBase + 0x100) = tcb_ptr_to_ctcb_ptr regionBase \<and> (\<forall>t. cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) (ret__struct_cap_C_' t)))}
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 8. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 9. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (9 subgoals):
 1. \<And>deviceMemory userSizea s. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); pspace_no_overlap' regionBase tcbBlockSizeBits s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s; valid_objs' s; untyped_ranges_zero' s; caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} s; range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0); {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}; if regionBase \<in> set (new_cap_addrs (Suc 0) regionBase (KOTCB makeObject)) then \<exists>obj. projectKO_opt (KOTCB makeObject) = Some obj else ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj) regionBase s; is_aligned regionBase (objBitsKO (KOTCB makeObject)); pspace_no_overlap' regionBase (objBitsKO (KOTCB makeObject)) s; pspace_aligned' s; pspace_distinct' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s))))) \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> tcb_Ptr (regionBase + 0x100) = tcb_ptr_to_ctcb_ptr regionBase \<and> (\<forall>t. cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) (ret__struct_cap_C_' t)))} \<inter> {s'. (s, s') \<in> rf_sr}) lvar_nondet_init tcb_' tcb_'_update {s'. (s, s') \<in> rf_sr}
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and (\<lambda>s. (if regionBase \<in> set (new_cap_addrs (2 ^ 0) regionBase (injectKOS makeObject)) then \<exists>obj. projectKO_opt (injectKOS makeObject) = Some obj else ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj) regionBase s) \<and> objBitsKO (injectKOS makeObject) + 0 < word_bits \<and> is_aligned regionBase (objBitsKO (injectKOS makeObject) + 0) \<and> pspace_no_overlap' regionBase (objBitsKO (injectKOS makeObject) + 0) s \<and> pspace_aligned' s \<and> pspace_distinct' s)) s \<and> s' \<in> {s. \<forall>v. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s))))) \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<longrightarrow> Kernel_C.CPSR <s 0x14 \<longrightarrow> 0 \<le>s Kernel_C.CPSR \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> tcb_Ptr (regionBase + 0x100) = tcb_ptr_to_ctcb_ptr regionBase \<and> (\<forall>t. cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) (ret__struct_cap_C_' t)))}
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 8. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 9. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase tcbBlockSizeBits and Invariants_H.valid_queues and (\<lambda>s. sym_refs (state_refs_of' s)) and (\<lambda>s. 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits}) and (\<lambda>y. regionBase \<noteq> 0 \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {}) and (\<lambda>s. (if regionBase \<in> set (new_cap_addrs (2 ^ 0) regionBase (injectKOS makeObject)) then \<exists>obj. projectKO_opt (injectKOS makeObject) = Some obj else ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj) regionBase s) \<and> objBitsKO (injectKOS makeObject) + 0 < word_bits \<and> is_aligned regionBase (objBitsKO (injectKOS makeObject) + 0) \<and> pspace_no_overlap' regionBase (objBitsKO (injectKOS makeObject) + 0) s \<and> pspace_aligned' s \<and> pspace_distinct' s)) s \<and> s' \<in> {s. \<forall>v. region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s))))) \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<longrightarrow> Kernel_C.CPSR <s 0x14 \<longrightarrow> 0 \<le>s Kernel_C.CPSR \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s) = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> tcb_Ptr (regionBase + 0x100) = tcb_ptr_to_ctcb_ptr regionBase \<and> (\<forall>t. cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) (ret__struct_cap_C_' t)))}
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ objBits makeObject) s'; \<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0; pspace_no_overlap' regionBase (objBits makeObject) s; caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject} s; 2 ^ objBits makeObject \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' regionBase tcbBlockSizeBits s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} s \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {} \<and> (if regionBase \<in> set (new_cap_addrs (Suc 0) regionBase (KOTCB makeObject)) then \<exists>obj. projectKO_opt (KOTCB makeObject) = Some obj else ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj) regionBase s) \<and> is_aligned regionBase (objBitsKO (KOTCB makeObject)) \<and> pspace_no_overlap' regionBase (objBitsKO (KOTCB makeObject)) s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))) \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<longrightarrow> Kernel_C.CPSR <s 0x14 \<longrightarrow> 0 \<le>s Kernel_C.CPSR \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> tcb_Ptr (regionBase + 0x100) = tcb_ptr_to_ctcb_ptr regionBase \<and> (\<forall>t. cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) (ret__struct_cap_C_' t)))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ objBits makeObject) s'; \<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0; pspace_no_overlap' regionBase (objBits makeObject) s; caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject} s; 2 ^ objBits makeObject \<le> gsMaxObjectSize s; pspace_aligned' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' regionBase tcbBlockSizeBits s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} s \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {} \<and> (if regionBase \<in> set (new_cap_addrs (Suc 0) regionBase (KOTCB makeObject)) then \<exists>obj. projectKO_opt (KOTCB makeObject) = Some obj else ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj) regionBase s) \<and> is_aligned regionBase (objBitsKO (KOTCB makeObject)) \<and> pspace_no_overlap' regionBase (objBitsKO (KOTCB makeObject)) s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))) \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<longrightarrow> Kernel_C.CPSR <s 0x14 \<longrightarrow> 0 \<le>s Kernel_C.CPSR \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> tcb_Ptr (regionBase + 0x100) = tcb_ptr_to_ctcb_ptr regionBase \<and> (\<forall>t. cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) (ret__struct_cap_C_' t)))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ objBits makeObject) s'; \<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0; pspace_no_overlap' regionBase (objBits makeObject) s; caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject} s; 2 ^ objBits makeObject \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' regionBase tcbBlockSizeBits s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} s \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {} \<and> (if regionBase \<in> set (new_cap_addrs (Suc 0) regionBase (KOTCB makeObject)) then \<exists>obj. projectKO_opt (KOTCB makeObject) = Some obj else ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj) regionBase s) \<and> is_aligned regionBase (objBitsKO (KOTCB makeObject)) \<and> pspace_no_overlap' regionBase (objBitsKO (KOTCB makeObject)) s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))) \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<longrightarrow> Kernel_C.CPSR <s 0x14 \<longrightarrow> 0 \<le>s Kernel_C.CPSR \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> tcb_Ptr (regionBase + 0x100) = tcb_ptr_to_ctcb_ptr regionBase \<and> (\<forall>t. cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) (ret__struct_cap_C_' t)))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ objBits makeObject) s'; \<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0; pspace_no_overlap' regionBase (objBits makeObject) s; caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject} s; 2 ^ objBits makeObject \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' regionBase tcbBlockSizeBits s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} s \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {} \<and> (if regionBase \<in> set (new_cap_addrs (Suc 0) regionBase (KOTCB makeObject)) then \<exists>obj. projectKO_opt (KOTCB makeObject) = Some obj else ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj) regionBase s) \<and> is_aligned regionBase (objBitsKO (KOTCB makeObject)) \<and> pspace_no_overlap' regionBase (objBitsKO (KOTCB makeObject)) s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))) \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<longrightarrow> Kernel_C.CPSR <s 0x14 \<longrightarrow> 0 \<le>s Kernel_C.CPSR \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> tcb_Ptr (regionBase + 0x100) = tcb_ptr_to_ctcb_ptr regionBase \<and> (\<forall>t. cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) (ret__struct_cap_C_' t)))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ objBits makeObject) s'; \<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0; pspace_no_overlap' regionBase (objBits makeObject) s; caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject} s; 2 ^ objBits makeObject \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s)\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' regionBase tcbBlockSizeBits s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> 2 ^ tcbBlockSizeBits \<le> gsMaxObjectSize s \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> caps_overlap_reserved' {regionBase..+2 ^ tcbBlockSizeBits} s \<and> range_cover regionBase tcbBlockSizeBits tcbBlockSizeBits (Suc 0) \<and> {regionBase..+2 ^ tcbBlockSizeBits} \<inter> kernel_data_refs = {} \<and> (if regionBase \<in> set (new_cap_addrs (Suc 0) regionBase (KOTCB makeObject)) then \<exists>obj. projectKO_opt (KOTCB makeObject) = Some obj else ko_wp_at' (\<lambda>ko. \<exists>obj. projectKO_opt ko = Some obj) regionBase s) \<and> is_aligned regionBase (objBitsKO (KOTCB makeObject)) \<and> pspace_no_overlap' regionBase (objBitsKO (KOTCB makeObject)) s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> region_actually_is_bytes regionBase (2 ^ tcbBlockSizeBits) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ tcbBlockSizeBits) regionBase = replicate (2 ^ tcbBlockSizeBits) 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))) \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<longrightarrow> Kernel_C.CPSR <s 0x14 \<longrightarrow> 0 \<le>s Kernel_C.CPSR \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> tcb_Ptr (regionBase + 0x100) = tcb_ptr_to_ctcb_ptr regionBase \<and> (\<forall>t. cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) (ret__struct_cap_C_' t)))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+512} \<inter> kernel_data_refs = {}; range_cover regionBase 9 9 (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase 512 s'; \<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0; pspace_no_overlap' regionBase 9 s; caps_overlap_reserved' {regionBase..+512} s; 512 \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s)\<rbrakk> \<Longrightarrow> valid_objs' s \<and> untyped_ranges_zero' s \<and> is_aligned regionBase 9 \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))) \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<longrightarrow> Kernel_C.CPSR <s 0x14 \<longrightarrow> 0 \<le>s Kernel_C.CPSR \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> tcb_Ptr (regionBase + 0x100) = tcb_ptr_to_ctcb_ptr regionBase \<and> (\<forall>t. cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) (ret__struct_cap_C_' t)))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+512} \<inter> kernel_data_refs = {}; range_cover regionBase 9 9 (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; invs' s; \<forall>x\<in>{regionBase..+512}. hrs_htd (t_hrs_' (globals s')) x = (True, [0 \<mapsto> (typ_uinfo_t TYPE(8 word), True)]); \<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0; pspace_no_overlap' regionBase 9 s; caps_overlap_reserved' {regionBase..+512} s; 512 \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s)\<rbrakk> \<Longrightarrow> valid_objs' s \<and> untyped_ranges_zero' s \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))) \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<longrightarrow> Kernel_C.CPSR <s 0x14 \<longrightarrow> 0 \<le>s Kernel_C.CPSR \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> tcb_Ptr (regionBase + 0x100) = tcb_ptr_to_ctcb_ptr regionBase \<and> (\<forall>t. cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) (ret__struct_cap_C_' t)))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+512} \<inter> kernel_data_refs = {}; range_cover regionBase 9 9 (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; invs' s; \<forall>x\<in>{regionBase..+512}. hrs_htd (t_hrs_' (globals s')) x = (True, [0 \<mapsto> (typ_uinfo_t TYPE(8 word), True)]); \<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0; pspace_no_overlap' regionBase 9 s; caps_overlap_reserved' {regionBase..+512} s; 512 \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')) = 0 \<or> word_of_nat 512 \<le> gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s'))\<rbrakk> \<Longrightarrow> valid_objs' s \<and> untyped_ranges_zero' s \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))) \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<longrightarrow> Kernel_C.CPSR <s 0x14 \<longrightarrow> 0 \<le>s Kernel_C.CPSR \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> tcb_Ptr (regionBase + 0x100) = tcb_ptr_to_ctcb_ptr regionBase \<and> (\<forall>t. cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap \<longrightarrow> ccap_relation (capability.ThreadCap regionBase) (ret__struct_cap_C_' t)))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> 5 \<le> 1; isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+512} \<inter> kernel_data_refs = {}; range_cover regionBase 9 9 (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.TCBObject); (s, s') \<in> rf_sr; invs' s; \<forall>x\<in>{regionBase..+512}. hrs_htd (t_hrs_' (globals s')) x = (True, [0 \<mapsto> (typ_uinfo_t TYPE(8 word), True)]); \<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0; pspace_no_overlap' regionBase 9 s; caps_overlap_reserved' {regionBase..+512} s; 512 \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')) = 0 \<or> 0x200 \<le> gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s'))\<rbrakk> \<Longrightarrow> valid_objs' s \<and> untyped_ranges_zero' s \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))) \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100) \<longrightarrow> Kernel_C.CPSR <s 0x14 \<longrightarrow> 0 \<le>s Kernel_C.CPSR \<longrightarrow> hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) (regionBase + 0x100 - ctcb_offset)) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']) \<longrightarrow> (\<exists>rv. ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv) \<longrightarrow> tcb_Ptr (regionBase + 0x100) = tcb_ptr_to_ctcb_ptr regionBase \<and> ((\<exists>t. cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr> \<and> cap_lift (ret__struct_cap_C_' t) = Some (Cap_thread_cap (cap_thread_cap_lift (ret__struct_cap_C_' t)))) \<longrightarrow> regionBase = ctcb_ptr_to_tcb_ptr (tcb_Ptr (regionBase + 0x100 && ~~ mask 4))))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea s s' rv t. \<lbrakk>\<not> 5 \<le> 1; \<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+512} \<inter> kernel_data_refs = {}; range_cover regionBase 9 9 (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; \<forall>x\<in>{regionBase..+512}. hrs_htd (t_hrs_' (globals s')) x = (True, [0 \<mapsto> (typ_uinfo_t TYPE(8 word), True)]); heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0; pspace_no_overlap' regionBase 9 s; caps_overlap_reserved' {regionBase..+512} s; 512 \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')) = 0 \<or> 0x200 \<le> gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))); hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); Kernel_C.CPSR <s 0x14; 0 \<le>s Kernel_C.CPSR; hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv; cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_thread_cap \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> regionBase = (regionBase + 0x100 && ~~ mask 4) - 0x100
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (10 subgoals):
 1. \<And>deviceMemory userSizea s s' rv t. \<lbrakk>\<not> 5 \<le> 1; \<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+512} \<inter> kernel_data_refs = {}; range_cover regionBase 9 9 (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; \<forall>x\<in>{regionBase..+512}. hrs_htd (t_hrs_' (globals s')) x = (True, [0 \<mapsto> (typ_uinfo_t TYPE(8 word), True)]); heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0; pspace_no_overlap' regionBase 9 s; caps_overlap_reserved' {regionBase..+512} s; 512 \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')) = 0 \<or> 0x200 \<le> gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))); hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); Kernel_C.CPSR <s 0x14; 0 \<le>s Kernel_C.CPSR; hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv; cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_thread_cap \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> is_aligned (regionBase + 0x100) (?n4285 deviceMemory userSizea s s' rv t)
 2. \<And>deviceMemory userSizea s s' rv t. \<lbrakk>\<not> 5 \<le> 1; \<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+512} \<inter> kernel_data_refs = {}; range_cover regionBase 9 9 (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; \<forall>x\<in>{regionBase..+512}. hrs_htd (t_hrs_' (globals s')) x = (True, [0 \<mapsto> (typ_uinfo_t TYPE(8 word), True)]); heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0; pspace_no_overlap' regionBase 9 s; caps_overlap_reserved' {regionBase..+512} s; 512 \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')) = 0 \<or> 0x200 \<le> gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))); hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); Kernel_C.CPSR <s 0x14; 0 \<le>s Kernel_C.CPSR; hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv; cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_thread_cap \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> 4 \<le> ?n4285 deviceMemory userSizea s s' rv t
 3. \<And>deviceMemory userSizea s s' rv t. \<lbrakk>\<not> 5 \<le> 1; \<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+512} \<inter> kernel_data_refs = {}; range_cover regionBase 9 9 (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; \<forall>x\<in>{regionBase..+512}. hrs_htd (t_hrs_' (globals s')) x = (True, [0 \<mapsto> (typ_uinfo_t TYPE(8 word), True)]); heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0; pspace_no_overlap' regionBase 9 s; caps_overlap_reserved' {regionBase..+512} s; 512 \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')) = 0 \<or> 0x200 \<le> gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))); hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); Kernel_C.CPSR <s 0x14; 0 \<le>s Kernel_C.CPSR; hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv; cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_thread_cap \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> regionBase = regionBase + 0x100 - 0x100
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 9. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 10. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (11 subgoals):
 1. \<And>deviceMemory userSizea s s' rv t. \<lbrakk>\<not> 5 \<le> 1; \<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+512} \<inter> kernel_data_refs = {}; range_cover regionBase 9 9 (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; \<forall>x\<in>{regionBase..+512}. hrs_htd (t_hrs_' (globals s')) x = (True, [0 \<mapsto> (typ_uinfo_t TYPE(8 word), True)]); heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0; pspace_no_overlap' regionBase 9 s; caps_overlap_reserved' {regionBase..+512} s; 512 \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')) = 0 \<or> 0x200 \<le> gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))); hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); Kernel_C.CPSR <s 0x14; 0 \<le>s Kernel_C.CPSR; hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv; cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_thread_cap \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> is_aligned regionBase 8
 2. \<And>deviceMemory userSizea s s' rv t. \<lbrakk>\<not> 5 \<le> 1; \<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+512} \<inter> kernel_data_refs = {}; range_cover regionBase 9 9 (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; \<forall>x\<in>{regionBase..+512}. hrs_htd (t_hrs_' (globals s')) x = (True, [0 \<mapsto> (typ_uinfo_t TYPE(8 word), True)]); heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0; pspace_no_overlap' regionBase 9 s; caps_overlap_reserved' {regionBase..+512} s; 512 \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')) = 0 \<or> 0x200 \<le> gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))); hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); Kernel_C.CPSR <s 0x14; 0 \<le>s Kernel_C.CPSR; hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv; cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_thread_cap \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> is_aligned 0x100 8
 3. \<And>deviceMemory userSizea s s' rv t. \<lbrakk>\<not> 5 \<le> 1; \<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+512} \<inter> kernel_data_refs = {}; range_cover regionBase 9 9 (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; \<forall>x\<in>{regionBase..+512}. hrs_htd (t_hrs_' (globals s')) x = (True, [0 \<mapsto> (typ_uinfo_t TYPE(8 word), True)]); heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0; pspace_no_overlap' regionBase 9 s; caps_overlap_reserved' {regionBase..+512} s; 512 \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')) = 0 \<or> 0x200 \<le> gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))); hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); Kernel_C.CPSR <s 0x14; 0 \<le>s Kernel_C.CPSR; hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv; cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_thread_cap \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> 4 \<le> 8
 4. \<And>deviceMemory userSizea s s' rv t. \<lbrakk>\<not> 5 \<le> 1; \<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+512} \<inter> kernel_data_refs = {}; range_cover regionBase 9 9 (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; \<forall>x\<in>{regionBase..+512}. hrs_htd (t_hrs_' (globals s')) x = (True, [0 \<mapsto> (typ_uinfo_t TYPE(8 word), True)]); heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0; pspace_no_overlap' regionBase 9 s; caps_overlap_reserved' {regionBase..+512} s; 512 \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')) = 0 \<or> 0x200 \<le> gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))); hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); Kernel_C.CPSR <s 0x14; 0 \<le>s Kernel_C.CPSR; hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv; cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_thread_cap \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> regionBase = regionBase + 0x100 - 0x100
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 9. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 10. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>deviceMemory userSizea s s' rv t. \<lbrakk>\<not> 5 \<le> 1; \<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+512} \<inter> kernel_data_refs = {}; range_cover regionBase 9 9 (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; \<forall>x\<in>{regionBase..+512}. hrs_htd (t_hrs_' (globals s')) x = (True, [0 \<mapsto> (typ_uinfo_t TYPE(8 word), True)]); heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0; pspace_no_overlap' regionBase 9 s; caps_overlap_reserved' {regionBase..+512} s; 512 \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')) = 0 \<or> 0x200 \<le> gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))); hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); Kernel_C.CPSR <s 0x14; 0 \<le>s Kernel_C.CPSR; hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv; cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_thread_cap \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> is_aligned 0x100 8
 2. \<And>deviceMemory userSizea s s' rv t. \<lbrakk>\<not> 5 \<le> 1; \<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+512} \<inter> kernel_data_refs = {}; range_cover regionBase 9 9 (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; \<forall>x\<in>{regionBase..+512}. hrs_htd (t_hrs_' (globals s')) x = (True, [0 \<mapsto> (typ_uinfo_t TYPE(8 word), True)]); heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0; pspace_no_overlap' regionBase 9 s; caps_overlap_reserved' {regionBase..+512} s; 512 \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')) = 0 \<or> 0x200 \<le> gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))); hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); Kernel_C.CPSR <s 0x14; 0 \<le>s Kernel_C.CPSR; hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv; cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_thread_cap \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> 4 \<le> 8
 3. \<And>deviceMemory userSizea s s' rv t. \<lbrakk>\<not> 5 \<le> 1; \<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+512} \<inter> kernel_data_refs = {}; range_cover regionBase 9 9 (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; \<forall>x\<in>{regionBase..+512}. hrs_htd (t_hrs_' (globals s')) x = (True, [0 \<mapsto> (typ_uinfo_t TYPE(8 word), True)]); heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0; pspace_no_overlap' regionBase 9 s; caps_overlap_reserved' {regionBase..+512} s; 512 \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')) = 0 \<or> 0x200 \<le> gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))); hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); Kernel_C.CPSR <s 0x14; 0 \<le>s Kernel_C.CPSR; hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv; cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_thread_cap \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> regionBase = regionBase + 0x100 - 0x100
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 9. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 10. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (9 subgoals):
 1. \<And>deviceMemory userSizea s s' rv t. \<lbrakk>\<not> 5 \<le> 1; \<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+512} \<inter> kernel_data_refs = {}; range_cover regionBase 9 9 (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; \<forall>x\<in>{regionBase..+512}. hrs_htd (t_hrs_' (globals s')) x = (True, [0 \<mapsto> (typ_uinfo_t TYPE(8 word), True)]); heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0; pspace_no_overlap' regionBase 9 s; caps_overlap_reserved' {regionBase..+512} s; 512 \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')) = 0 \<or> 0x200 \<le> gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))); hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); Kernel_C.CPSR <s 0x14; 0 \<le>s Kernel_C.CPSR; hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv; cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_thread_cap \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> 4 \<le> 8
 2. \<And>deviceMemory userSizea s s' rv t. \<lbrakk>\<not> 5 \<le> 1; \<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+512} \<inter> kernel_data_refs = {}; range_cover regionBase 9 9 (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; \<forall>x\<in>{regionBase..+512}. hrs_htd (t_hrs_' (globals s')) x = (True, [0 \<mapsto> (typ_uinfo_t TYPE(8 word), True)]); heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0; pspace_no_overlap' regionBase 9 s; caps_overlap_reserved' {regionBase..+512} s; 512 \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')) = 0 \<or> 0x200 \<le> gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))); hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); Kernel_C.CPSR <s 0x14; 0 \<le>s Kernel_C.CPSR; hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv; cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_thread_cap \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> regionBase = regionBase + 0x100 - 0x100
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 8. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 9. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea s s' rv t. \<lbrakk>\<not> 5 \<le> 1; \<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.TCBObject; regionBase \<noteq> 0; {regionBase..+512} \<inter> kernel_data_refs = {}; range_cover regionBase 9 9 (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; \<forall>x\<in>{regionBase..+512}. hrs_htd (t_hrs_' (globals s')) x = (True, [0 \<mapsto> (typ_uinfo_t TYPE(8 word), True)]); heap_list (hrs_mem (t_hrs_' (globals s'))) 512 regionBase = replicate 512 0; pspace_no_overlap' regionBase 9 s; caps_overlap_reserved' {regionBase..+512} s; 512 \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')) = 0 \<or> 0x200 \<le> gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) (hrs_htd (t_hrs_' (globals s'))))); hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t tcb_Ptr (regionBase + 0x100); Kernel_C.CPSR <s 0x14; 0 \<le>s Kernel_C.CPSR; hrs_htd (hrs_htd_update (\<lambda>x. ptr_retyp (PTR(cte_C[5]) regionBase) (ptr_retyp (tcb_Ptr (regionBase + 0x100)) x)) (t_hrs_' (globals s'))) \<Turnstile>\<^sub>t PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_Ptr (regionBase + 0x100)\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C'']); ksCurDomain_' (globals s') = UCAST(8 \<rightarrow> 32) rv; cap_thread_cap_lift (ret__struct_cap_C_' t) = \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_thread_cap \<lparr>cap_thread_cap_CL.capTCBPtr_CL = regionBase + 0x100 && ~~ mask 4\<rparr>)\<rbrakk> \<Longrightarrow> regionBase = regionBase + 0x100 - 0x100
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.EndpointObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea apiType) (?P3'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 6. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 7. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea ArchTypes_H.apiobject_type.EndpointObject) (?P3'3615 deviceMemory userSizea ArchTypes_H.apiobject_type.EndpointObject) [SKIP] (case toAPIType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 6. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 7. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea ArchTypes_H.apiobject_type.EndpointObject) (?P3'3615 deviceMemory userSizea ArchTypes_H.apiobject_type.EndpointObject) [SKIP] (case toAPIType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 6. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 7. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P3.3615 deviceMemory userSizea ArchTypes_H.apiobject_type.EndpointObject) (?P3'3615 deviceMemory userSizea ArchTypes_H.apiobject_type.EndpointObject) [SKIP] (do y <- placeNewObject regionBase makeObject 0;
return (capability.EndpointCap regionBase 0 True True True True)
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
(\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> ?P3.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> ?P3'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 6. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 7. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q4302 deviceMemory userSizea) (?Q'4302 deviceMemory userSizea) [SKIP] (do y <- placeNewObject regionBase makeObject 0;
return (capability.EndpointCap regionBase 0 True True True True)
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
(\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'))
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> ?Q4302 deviceMemory userSizea s \<and> s' \<in> ?Q'4302 deviceMemory userSizea
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q4302 deviceMemory userSizea) (?G'4303 deviceMemory userSizea rv') [SKIP] (do y <- placeNewObject regionBase makeObject 0;
return (capability.EndpointCap regionBase 0 True True True True)
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
(\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'))
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> ?Q4302 deviceMemory userSizea s \<and> s' \<in> {s. s \<in> ?G'4303 deviceMemory userSizea ()}
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q4302 deviceMemory userSizea) (?G'4303 deviceMemory userSizea ()) [SKIP] (do y <- placeNewObject regionBase makeObject 0;
return (capability.EndpointCap regionBase 0 True True True True)
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ep_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
(\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'))
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> ?Q4302 deviceMemory userSizea s \<and> s' \<in> {s. s \<in> ?G'4303 deviceMemory userSizea ()}
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (10 subgoals):
 1. \<And>deviceMemory userSizea rv xfdc. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q4322 deviceMemory userSizea rv) (?Q'4322 deviceMemory userSizea rv xfdc) [SKIP] (return (capability.EndpointCap regionBase 0 True True True True)) (\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4322 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>?Q4322 deviceMemory userSizea\<rbrace>
 3. \<And>deviceMemory userSizea s rv. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'4322 deviceMemory userSizea rv (xfdc s)
 4. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (objBits makeObject) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject}) and (\<lambda>s. 2 ^ objBits makeObject \<le> gsMaxObjectSize s) and K (regionBase \<noteq> 0 \<and> range_cover regionBase (objBits makeObject) (objBits makeObject) 1 \<and> {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}) and ?R4322 deviceMemory userSizea) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ objBits makeObject) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0}}
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 9. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 10. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (12 subgoals):
 1. \<And>deviceMemory userSizea rv xfdc. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q4322 deviceMemory userSizea rv) (?Q'4348 deviceMemory userSizea rv xfdc) [SKIP] (return (capability.EndpointCap regionBase 0 True True True True)) (return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemory userSizea rv xfdc. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4322 deviceMemory userSizea rv xfdc) \<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase) (?Q'4348 deviceMemory userSizea rv xfdc)
 3. \<And>deviceMemory userSizea rv xfdc s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); dc rv xfdc; ?Q4322 deviceMemory userSizea rv s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4322 deviceMemory userSizea rv xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase) {s'. (s, s') \<in> rf_sr}
 4. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4322 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>?Q4322 deviceMemory userSizea\<rbrace>
 5. \<And>deviceMemory userSizea s rv. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'4322 deviceMemory userSizea rv (xfdc s)
 6. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (objBits makeObject) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject}) and (\<lambda>s. 2 ^ objBits makeObject \<le> gsMaxObjectSize s) and K (regionBase \<noteq> 0 \<and> range_cover regionBase (objBits makeObject) (objBits makeObject) 1 \<and> {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}) and ?R4322 deviceMemory userSizea) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ objBits makeObject) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0}}
 7. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 8. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 9. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 10. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>deviceMemory userSizea rv xfdc. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4322 deviceMemory userSizea rv xfdc) \<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase) \<lbrace>ccap_relation (capability.EndpointCap regionBase 0 True True True True) \<acute>ret__struct_cap_C\<rbrace>
 2. \<And>deviceMemory userSizea rv xfdc s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); dc rv xfdc; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4322 deviceMemory userSizea rv xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase) {s'. (s, s') \<in> rf_sr}
 3. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4322 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>\<lambda>rv _. True\<rbrace>
 4. \<And>deviceMemory userSizea s rv. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'4322 deviceMemory userSizea rv (xfdc s)
 5. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (objBits makeObject) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject}) and (\<lambda>s. 2 ^ objBits makeObject \<le> gsMaxObjectSize s) and K (regionBase \<noteq> 0 \<and> range_cover regionBase (objBits makeObject) (objBits makeObject) 1 \<and> {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}) and ?R4322 deviceMemory userSizea) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ objBits makeObject) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0}}
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 9. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 10. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>deviceMemory userSizea rv xfdc s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); dc rv xfdc; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<forall>t. cap_endpoint_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = \<lparr>capEPBadge_CL = 0 && mask 28, capCanGrantReply_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capCanSend_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capCanReceive_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capEPPtr_CL = regionBase && ~~ mask 4\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> ccap_relation (capability.EndpointCap regionBase 0 True True True True) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase) {s'. (s, s') \<in> rf_sr}
 2. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4322 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>\<lambda>rv _. True\<rbrace>
 3. \<And>deviceMemory userSizea s rv. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>\<forall>t. cap_endpoint_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = \<lparr>capEPBadge_CL = 0 && mask 28, capCanGrantReply_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capCanSend_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capCanReceive_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capEPPtr_CL = regionBase && ~~ mask 4\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> ccap_relation (capability.EndpointCap regionBase 0 True True True True) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>
 4. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (objBits makeObject) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject}) and (\<lambda>s. 2 ^ objBits makeObject \<le> gsMaxObjectSize s) and K (regionBase \<noteq> 0 \<and> range_cover regionBase (objBits makeObject) (objBits makeObject) 1 \<and> {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}) and ?R4322 deviceMemory userSizea) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ objBits makeObject) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0}}
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 9. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 10. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (9 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4322 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>\<lambda>rv _. True\<rbrace>
 2. \<And>deviceMemory userSizea s rv. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>\<forall>t. cap_endpoint_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = \<lparr>capEPBadge_CL = 0 && mask 28, capCanGrantReply_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capCanSend_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capCanReceive_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capEPPtr_CL = regionBase && ~~ mask 4\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> ccap_relation (capability.EndpointCap regionBase 0 True True True True) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>
 3. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (objBits makeObject) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject}) and (\<lambda>s. 2 ^ objBits makeObject \<le> gsMaxObjectSize s) and K (regionBase \<noteq> 0 \<and> range_cover regionBase (objBits makeObject) (objBits makeObject) 1 \<and> {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}) and ?R4322 deviceMemory userSizea) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ objBits makeObject) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0}}
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 8. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 9. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea s rv. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>\<forall>t. cap_endpoint_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = \<lparr>capEPBadge_CL = 0 && mask 28, capCanGrantReply_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capCanGrant_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capCanSend_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capCanReceive_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capEPPtr_CL = regionBase && ~~ mask 4\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> ccap_relation (capability.EndpointCap regionBase 0 True True True True) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (objBits makeObject) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject}) and (\<lambda>s. 2 ^ objBits makeObject \<le> gsMaxObjectSize s) and K (regionBase \<noteq> 0 \<and> range_cover regionBase (objBits makeObject) (objBits makeObject) 1 \<and> {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}) and (\<lambda>s. True)) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ objBits makeObject) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0}}
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.EndpointObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (objBits makeObject) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject}) and (\<lambda>s. 2 ^ objBits makeObject \<le> gsMaxObjectSize s) and K (regionBase \<noteq> 0 \<and> range_cover regionBase (objBits makeObject) (objBits makeObject) 1 \<and> {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}) and (\<lambda>s. True)) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ objBits makeObject) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0}}
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 6. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 7. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ objBits makeObject) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0; pspace_no_overlap' regionBase (objBits makeObject) s; caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject} s; 2 ^ objBits makeObject \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_objs' s \<and> untyped_ranges_zero' s
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 6. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 7. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ objBits makeObject) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0; pspace_no_overlap' regionBase (objBits makeObject) s; caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject} s; 2 ^ objBits makeObject \<le> gsMaxObjectSize s; pspace_aligned' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_objs' s \<and> untyped_ranges_zero' s
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 6. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 7. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ objBits makeObject) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0; pspace_no_overlap' regionBase (objBits makeObject) s; caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject} s; 2 ^ objBits makeObject \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_objs' s \<and> untyped_ranges_zero' s
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 6. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 7. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ objBits makeObject) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0; pspace_no_overlap' regionBase (objBits makeObject) s; caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject} s; 2 ^ objBits makeObject \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_objs' s \<and> untyped_ranges_zero' s
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 6. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 7. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.EndpointObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ objBits makeObject) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0; pspace_no_overlap' regionBase (objBits makeObject) s; caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject} s; 2 ^ objBits makeObject \<le> gsMaxObjectSize s; pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s)\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_objs' s \<and> untyped_ranges_zero' s
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 6. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 7. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.NotificationObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea apiType) (?P4'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea ArchTypes_H.apiobject_type.NotificationObject) (?P4'3615 deviceMemory userSizea ArchTypes_H.apiobject_type.NotificationObject) [SKIP] (case toAPIType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea ArchTypes_H.apiobject_type.NotificationObject) (?P4'3615 deviceMemory userSizea ArchTypes_H.apiobject_type.NotificationObject) [SKIP] (case toAPIType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P4.3615 deviceMemory userSizea ArchTypes_H.apiobject_type.NotificationObject) (?P4'3615 deviceMemory userSizea ArchTypes_H.apiobject_type.NotificationObject) [SKIP] (do y <- placeNewObject regionBase makeObject 0;
return (capability.NotificationCap regionBase 0 True True)
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
(\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'))
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> ?P4.3615 deviceMemory userSizea apiType s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> ?P4'3615 deviceMemory userSizea apiType} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q4433 deviceMemory userSizea) (?Q'4433 deviceMemory userSizea) [SKIP] (do y <- placeNewObject regionBase makeObject 0;
return (capability.NotificationCap regionBase 0 True True)
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
(\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'))
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> ?Q4433 deviceMemory userSizea s \<and> s' \<in> ?Q'4433 deviceMemory userSizea
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 6. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 7. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q4433 deviceMemory userSizea) (?G'4434 deviceMemory userSizea rv') [SKIP] (do y <- placeNewObject regionBase makeObject 0;
return (capability.NotificationCap regionBase 0 True True)
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
(\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'))
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> ?Q4433 deviceMemory userSizea s \<and> s' \<in> {s. s \<in> ?G'4434 deviceMemory userSizea ()}
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 6. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 7. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q4433 deviceMemory userSizea) (?G'4434 deviceMemory userSizea ()) [SKIP] (do y <- placeNewObject regionBase makeObject 0;
return (capability.NotificationCap regionBase 0 True True)
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_retyp (ntfn_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
(\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'))
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> ?Q4433 deviceMemory userSizea s \<and> s' \<in> {s. s \<in> ?G'4434 deviceMemory userSizea ()}
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 6. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 7. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (9 subgoals):
 1. \<And>deviceMemory userSizea rv xfdc. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q4453 deviceMemory userSizea rv) (?Q'4453 deviceMemory userSizea rv xfdc) [SKIP] (return (capability.NotificationCap regionBase 0 True True)) (\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4453 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>?Q4453 deviceMemory userSizea\<rbrace>
 3. \<And>deviceMemory userSizea s rv. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'4453 deviceMemory userSizea rv (xfdc s)
 4. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 4 and (\<lambda>s. 2 ^ ntfnSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ ntfnSizeBits}) and K (regionBase \<noteq> 0 \<and> {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {} \<and> range_cover regionBase ntfnSizeBits ntfnSizeBits 1) and ?R4453 deviceMemory userSizea) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ ntfnSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ ntfnSizeBits) regionBase = replicate (2 ^ ntfnSizeBits) 0}}
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 8. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 9. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (11 subgoals):
 1. \<And>deviceMemory userSizea rv xfdc. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q4453 deviceMemory userSizea rv) (?Q'4477 deviceMemory userSizea rv xfdc) [SKIP] (return (capability.NotificationCap regionBase 0 True True)) (return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemory userSizea rv xfdc. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4453 deviceMemory userSizea rv xfdc) \<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase) (?Q'4477 deviceMemory userSizea rv xfdc)
 3. \<And>deviceMemory userSizea rv xfdc s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); dc rv xfdc; ?Q4453 deviceMemory userSizea rv s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4453 deviceMemory userSizea rv xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase) {s'. (s, s') \<in> rf_sr}
 4. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4453 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>?Q4453 deviceMemory userSizea\<rbrace>
 5. \<And>deviceMemory userSizea s rv. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'4453 deviceMemory userSizea rv (xfdc s)
 6. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 4 and (\<lambda>s. 2 ^ ntfnSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ ntfnSizeBits}) and K (regionBase \<noteq> 0 \<and> {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {} \<and> range_cover regionBase ntfnSizeBits ntfnSizeBits 1) and ?R4453 deviceMemory userSizea) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ ntfnSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ ntfnSizeBits) regionBase = replicate (2 ^ ntfnSizeBits) 0}}
 7. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 9. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 10. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>deviceMemory userSizea rv xfdc. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4453 deviceMemory userSizea rv xfdc) \<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase) \<lbrace>ccap_relation (capability.NotificationCap regionBase 0 True True) \<acute>ret__struct_cap_C\<rbrace>
 2. \<And>deviceMemory userSizea rv xfdc s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); dc rv xfdc; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4453 deviceMemory userSizea rv xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase) {s'. (s, s') \<in> rf_sr}
 3. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4453 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>\<lambda>rv _. True\<rbrace>
 4. \<And>deviceMemory userSizea s rv. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'4453 deviceMemory userSizea rv (xfdc s)
 5. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 4 and (\<lambda>s. 2 ^ ntfnSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ ntfnSizeBits}) and K (regionBase \<noteq> 0 \<and> {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {} \<and> range_cover regionBase ntfnSizeBits ntfnSizeBits 1) and ?R4453 deviceMemory userSizea) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ ntfnSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ ntfnSizeBits) regionBase = replicate (2 ^ ntfnSizeBits) 0}}
 6. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 9. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 10. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (9 subgoals):
 1. \<And>deviceMemory userSizea rv xfdc s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); dc rv xfdc; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<forall>t. cap_notification_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = \<lparr>capNtfnBadge_CL = 0 && mask 28, capNtfnCanReceive_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capNtfnCanSend_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capNtfnPtr_CL = regionBase && ~~ mask 4\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> ccap_relation (capability.NotificationCap regionBase 0 True True) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase) {s'. (s, s') \<in> rf_sr}
 2. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4453 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>\<lambda>rv _. True\<rbrace>
 3. \<And>deviceMemory userSizea s rv. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>\<forall>t. cap_notification_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = \<lparr>capNtfnBadge_CL = 0 && mask 28, capNtfnCanReceive_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capNtfnCanSend_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capNtfnPtr_CL = regionBase && ~~ mask 4\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> ccap_relation (capability.NotificationCap regionBase 0 True True) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>
 4. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 4 and (\<lambda>s. 2 ^ ntfnSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ ntfnSizeBits}) and K (regionBase \<noteq> 0 \<and> {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {} \<and> range_cover regionBase ntfnSizeBits ntfnSizeBits 1) and ?R4453 deviceMemory userSizea) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ ntfnSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ ntfnSizeBits) regionBase = replicate (2 ^ ntfnSizeBits) 0}}
 5. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 8. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 9. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4453 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject 0 \<lbrace>\<lambda>rv _. True\<rbrace>
 2. \<And>deviceMemory userSizea s rv. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>\<forall>t. cap_notification_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = \<lparr>capNtfnBadge_CL = 0 && mask 28, capNtfnCanReceive_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capNtfnCanSend_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capNtfnPtr_CL = regionBase && ~~ mask 4\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> ccap_relation (capability.NotificationCap regionBase 0 True True) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>
 3. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 4 and (\<lambda>s. 2 ^ ntfnSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ ntfnSizeBits}) and K (regionBase \<noteq> 0 \<and> {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {} \<and> range_cover regionBase ntfnSizeBits ntfnSizeBits 1) and ?R4453 deviceMemory userSizea) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ ntfnSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ ntfnSizeBits) regionBase = replicate (2 ^ ntfnSizeBits) 0}}
 4. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemory userSizea s rv. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); dc rv (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> \<lbrace>\<forall>t. cap_notification_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = \<lparr>capNtfnBadge_CL = 0 && mask 28, capNtfnCanReceive_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capNtfnCanSend_CL = SCAST(32 signed \<rightarrow> 32) true && mask 1, capNtfnPtr_CL = regionBase && ~~ mask 4\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_notification_cap \<longrightarrow> ccap_relation (capability.NotificationCap regionBase 0 True True) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 4 and (\<lambda>s. 2 ^ ntfnSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ ntfnSizeBits}) and K (regionBase \<noteq> 0 \<and> {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {} \<and> range_cover regionBase ntfnSizeBits ntfnSizeBits 1) and (\<lambda>s. True)) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ ntfnSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ ntfnSizeBits) regionBase = replicate (2 ^ ntfnSizeBits) 0}}
 3. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 6. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 7. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.NotificationObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase 4 and (\<lambda>s. 2 ^ ntfnSizeBits \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ ntfnSizeBits}) and K (regionBase \<noteq> 0 \<and> {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {} \<and> range_cover regionBase ntfnSizeBits ntfnSizeBits 1) and (\<lambda>s. True)) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ ntfnSizeBits) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ ntfnSizeBits) regionBase = replicate (2 ^ ntfnSizeBits) 0}}
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ objBits makeObject) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0; pspace_no_overlap' regionBase (objBits makeObject) s; caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject} s; 2 ^ objBits makeObject \<le> gsMaxObjectSize s; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0)\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' regionBase 4 s \<and> 2 ^ ntfnSizeBits \<le> gsMaxObjectSize s \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> caps_overlap_reserved' {regionBase..+2 ^ ntfnSizeBits} s \<and> region_actually_is_bytes regionBase (2 ^ ntfnSizeBits) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ ntfnSizeBits) regionBase = replicate (2 ^ ntfnSizeBits) 0
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ objBits makeObject) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0; pspace_no_overlap' regionBase (objBits makeObject) s; caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject} s; 2 ^ objBits makeObject \<le> gsMaxObjectSize s; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); pspace_aligned' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' regionBase 4 s \<and> 2 ^ ntfnSizeBits \<le> gsMaxObjectSize s \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> caps_overlap_reserved' {regionBase..+2 ^ ntfnSizeBits} s \<and> region_actually_is_bytes regionBase (2 ^ ntfnSizeBits) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ ntfnSizeBits) regionBase = replicate (2 ^ ntfnSizeBits) 0
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ objBits makeObject) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0; pspace_no_overlap' regionBase (objBits makeObject) s; caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject} s; 2 ^ objBits makeObject \<le> gsMaxObjectSize s; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); pspace_aligned' s; pspace_distinct' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' regionBase 4 s \<and> 2 ^ ntfnSizeBits \<le> gsMaxObjectSize s \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> caps_overlap_reserved' {regionBase..+2 ^ ntfnSizeBits} s \<and> region_actually_is_bytes regionBase (2 ^ ntfnSizeBits) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ ntfnSizeBits) regionBase = replicate (2 ^ ntfnSizeBits) 0
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ objBits makeObject) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0; pspace_no_overlap' regionBase (objBits makeObject) s; caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject} s; 2 ^ objBits makeObject \<le> gsMaxObjectSize s; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' regionBase 4 s \<and> 2 ^ ntfnSizeBits \<le> gsMaxObjectSize s \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> caps_overlap_reserved' {regionBase..+2 ^ ntfnSizeBits} s \<and> region_actually_is_bytes regionBase (2 ^ ntfnSizeBits) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ ntfnSizeBits) regionBase = replicate (2 ^ ntfnSizeBits) 0
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.NotificationObject; regionBase \<noteq> 0; {regionBase..+2 ^ ntfnSizeBits} \<inter> kernel_data_refs = {}; range_cover regionBase ntfnSizeBits ntfnSizeBits (Suc 0); \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ objBits makeObject) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0; pspace_no_overlap' regionBase (objBits makeObject) s; caps_overlap_reserved' {regionBase..+2 ^ objBits makeObject} s; 2 ^ objBits makeObject \<le> gsMaxObjectSize s; {regionBase..+2 ^ objBits makeObject} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject) (objBits makeObject) (Suc 0); pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s)\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' regionBase 4 s \<and> 2 ^ ntfnSizeBits \<le> gsMaxObjectSize s \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> caps_overlap_reserved' {regionBase..+2 ^ ntfnSizeBits} s \<and> region_actually_is_bytes regionBase (2 ^ ntfnSizeBits) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ ntfnSizeBits) regionBase = replicate (2 ^ ntfnSizeBits) 0
 2. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 2. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 4. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 5. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemory userSizea apiType. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); apiType = ArchTypes_H.apiobject_type.CapTableObject\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea apiType) (?P5'3615 deviceMemory userSizea apiType) [SKIP] (case toAPIType (APIObjectType apiType) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType apiType) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType apiType) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 2. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 4. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 5. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (objBits makeObject + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject + unat userSizea) (objBits makeObject + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea ArchTypes_H.apiobject_type.CapTableObject) (?P5'3615 deviceMemory userSizea ArchTypes_H.apiobject_type.CapTableObject) [SKIP] (case toAPIType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 2. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 4. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 5. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea ArchTypes_H.apiobject_type.CapTableObject) (?P5'3615 deviceMemory userSizea ArchTypes_H.apiobject_type.CapTableObject) [SKIP] (case toAPIType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) of None \<Rightarrow> do archCap <- Arch.createObject (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) regionBase (unat userSizea) (to_bool deviceMemory);
return $ capability.ArchObjectCap archCap
od | Some ArchTypes_H.apiobject_type.Untyped \<Rightarrow> return $ capability.UntypedCap (to_bool deviceMemory) (PPtr $ fromPPtr regionBase) (unat userSizea) 0 | Some ArchTypes_H.apiobject_type.TCBObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
curdom <- curDomain;
threadSet (tcbDomain_update (\<lambda>_. curdom)) (PPtr $ fromPPtr regionBase);
return $ capability.ThreadCap (PPtr $ fromPPtr regionBase)
od | Some ArchTypes_H.apiobject_type.EndpointObject \<Rightarrow> do placeNewObject regionBase makeObject 0;
return $ capability.EndpointCap (PPtr $ fromPPtr regionBase) 0 True True True True
od | Some ArchTypes_H.apiobject_type.NotificationObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject 0;
return $ capability.NotificationCap (PPtr $ fromPPtr regionBase) 0 True True
od | Some ArchTypes_H.apiobject_type.CapTableObject \<Rightarrow> do placeNewObject (PPtr $ fromPPtr regionBase) makeObject (unat userSizea);
modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = fromPPtr regionBase then Just (unat userSizea) else gsCNodes ks y\<rparr>);
return $ capability.CNodeCap (PPtr $ fromPPtr regionBase) (unat userSizea) 0 0
od) (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) = SCAST(32 signed \<rightarrow> 32) seL4_TCBObject then UNIV else {}) (lvar_nondet_init tcb_' tcb_'_update;;
\<acute>tcb :== tcb_Ptr (regionBase + 0x100);;
Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (PTR(cte_C[5]) (ptr_val \<acute>tcb - ctcb_offset)) \<circ> ptr_retyp \<acute>tcb)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (CALL Arch_initContext_'proc(PTR(user_context_C) &(PTR(arch_tcb_C) &(\<acute>tcb\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbTimeSlice_C''])) 5)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) &(\<acute>tcb\<rightarrow>[''tcbDomain_C''])) \<acute>ksCurDomain)));;
\<acute>ret__struct_cap_C :== CALL cap_thread_cap_new_'proc(ptr_val \<acute>tcb);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) = SCAST(32 signed \<rightarrow> 32) seL4_EndpointObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ep_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ep_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_endpoint_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) = SCAST(32 signed \<rightarrow> 32) seL4_NotificationObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_retyp (ntfn_Ptr regionBase))));;
\<acute>ret__struct_cap_C :== CALL cap_notification_cap_new_'proc(0,SCAST(32 signed \<rightarrow> 32) true,SCAST(32 signed \<rightarrow> 32) true,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) = SCAST(32 signed \<rightarrow> 32) seL4_CapTableObject then UNIV else {}) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Cond (if object_type_from_H (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) = SCAST(32 signed \<rightarrow> 32) seL4_UntypedObject then UNIV else {}) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_new_'proc(0,if deviceMemory \<noteq> 0 then 1 else 0,userSizea,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (Guard DontReach {} SKIP))))))
 2. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 4. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 5. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?P5.3615 deviceMemory userSizea ArchTypes_H.apiobject_type.CapTableObject) (?P5'3615 deviceMemory userSizea ArchTypes_H.apiobject_type.CapTableObject) [SKIP] (do y <- placeNewObject regionBase makeObject (unat userSizea);
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = regionBase then Some (unat userSizea) else gsCNodes ks y\<rparr>);
return (capability.CNodeCap regionBase (unat userSizea) 0 0)
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
(\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
(\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')))
 2. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> ?P5.3615 deviceMemory userSizea apiType s)) s
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> ?P5'3615 deviceMemory userSizea apiType}
 4. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 5. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q4566 deviceMemory userSizea) (?Q'4566 deviceMemory userSizea) [SKIP] (do y <- placeNewObject regionBase makeObject (unat userSizea);
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = regionBase then Some (unat userSizea) else gsCNodes ks y\<rparr>);
return (capability.CNodeCap regionBase (unat userSizea) 0 0)
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
(\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (4 + unat userSizea));;
(\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')))
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> ?Q4566 deviceMemory userSizea s \<and> s' \<in> ?Q'4566 deviceMemory userSizea
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q4566 deviceMemory userSizea) (?Q'4566 deviceMemory userSizea) [SKIP] (do y <- placeNewObject regionBase makeObject (unat userSizea);
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = regionBase then Some (unat userSizea) else gsCNodes ks y\<rparr>);
return (capability.CNodeCap regionBase (unat userSizea) 0 0)
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
(\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4));;
(\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')))
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> ?Q4566 deviceMemory userSizea s \<and> s' \<in> ?Q'4566 deviceMemory userSizea
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q4566 deviceMemory userSizea) (?G'4573 deviceMemory userSizea rv') [SKIP] (do y <- placeNewObject regionBase makeObject (unat userSizea);
y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = regionBase then Some (unat userSizea) else gsCNodes ks y\<rparr>);
return (capability.CNodeCap regionBase (unat userSizea) 0 0)
od) (Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))));;
(\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4));;
(\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')))
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> ?Q4566 deviceMemory userSizea s \<and> s' \<in> {s. s \<in> ?G'4573 deviceMemory userSizea ()}
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea rv' y xfdc. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); dc y xfdc\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q4597 deviceMemory userSizea rv' y) (?Q'4597 deviceMemory userSizea rv' y xfdc) [SKIP] (do y <- modify (\<lambda>ks. ks\<lparr>gsCNodes := \<lambda>y. if y = regionBase then Some (unat userSizea) else gsCNodes ks y\<rparr>);
return (capability.CNodeCap regionBase (unat userSizea) 0 0)
od) (\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4));;
(\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'))
 2. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4599 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject (unat userSizea) \<lbrace>?Q4597 deviceMemory userSizea rv'\<rbrace>
 3. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4597 deviceMemory userSizea rv') Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'4597 deviceMemory userSizea rv' y (xfdc s)}
 4. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (unat userSizea + cteSizeBits) and (\<lambda>s. 2 ^ (unat userSizea + cteSizeBits) \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + cteSizeBits)}) and K (regionBase \<noteq> 0 \<and> range_cover regionBase (unat userSizea + cteSizeBits) (unat userSizea + cteSizeBits) 1 \<and> {regionBase..+2 ^ (unat userSizea + cteSizeBits)} \<inter> kernel_data_refs = {}) and ?R4599 deviceMemory userSizea) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0} \<inter> ?R'4597 deviceMemory userSizea ()}
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea rv' y xfdc. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); dc y xfdc\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q4637 deviceMemory userSizea rv' y xfdc (?deviceMemory4637 deviceMemory userSizea rv' y xfdc) userSizea (?rv'4637 deviceMemory userSizea rv' y xfdc) (?y4637 deviceMemory userSizea rv' y xfdc)) (?Q'4637 deviceMemory userSizea rv' y xfdc (?deviceMemory4637 deviceMemory userSizea rv' y xfdc) userSizea (?rv'4637 deviceMemory userSizea rv' y xfdc) (?y4637 deviceMemory userSizea rv' y xfdc) (?xfdc4637 deviceMemory userSizea rv' y xfdc)) [SKIP] (do y <- modify (gsCNodes_update (\<lambda>a b. if b = regionBase then Some (unat userSizea) else a b));
return (capability.CNodeCap regionBase (unat userSizea) 0 0)
od) (\<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4));;
(\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'))
 2. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4599 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject (unat userSizea) \<lbrace>?Q4597 deviceMemory userSizea rv'\<rbrace>
 3. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4597 deviceMemory userSizea rv') Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'4637 deviceMemory userSizea rv' y (xfdc s) (?deviceMemory4637 deviceMemory userSizea rv' y (xfdc s)) userSizea (?rv'4637 deviceMemory userSizea rv' y (xfdc s)) (?y4637 deviceMemory userSizea rv' y (xfdc s)) (?xfdc4637 deviceMemory userSizea rv' y (xfdc s))}
 4. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (unat userSizea + cteSizeBits) and (\<lambda>s. 2 ^ (unat userSizea + cteSizeBits) \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + cteSizeBits)}) and K (regionBase \<noteq> 0 \<and> range_cover regionBase (unat userSizea + cteSizeBits) (unat userSizea + cteSizeBits) 1 \<and> {regionBase..+2 ^ (unat userSizea + cteSizeBits)} \<inter> kernel_data_refs = {}) and ?R4599 deviceMemory userSizea) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0} \<inter> ?R'4597 deviceMemory userSizea ()}
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})}
flex-flex pairs:
\<lambda>deviceMemory userSizea rv' y xfdc. ?Q4637 deviceMemory userSizea rv' y xfdc (?deviceMemory4637 deviceMemory userSizea rv' y xfdc) userSizea (?rv'4637 deviceMemory userSizea rv' y xfdc) (?y4637 deviceMemory userSizea rv' y xfdc) \<equiv>\<^sup>? \<lambda>deviceMemory userSizea rv' y xfdc. ?Q4597 deviceMemory userSizea rv' y proof (prove)
goal (10 subgoals):
 1. \<And>deviceMemory userSizea rv' y xfdca rv xfdc. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); dc y xfdca; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q4641 deviceMemory userSizea rv' y xfdca rv) (?Q'4641 deviceMemory userSizea rv' y xfdca rv xfdc) [SKIP] (return (capability.CNodeCap regionBase (unat userSizea) 0 0)) (\<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemory userSizea rv' y xfdc. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4649 deviceMemory userSizea rv' y xfdc regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y xfdc) (?y4637 deviceMemory userSizea rv' y xfdc)\<rbrace> modify (gsCNodes_update (\<lambda>a b. if b = regionBase then Some (unat userSizea) else a b)) \<lbrace>?Q4641 deviceMemory userSizea rv' y xfdc\<rbrace>
 3. \<And>deviceMemory userSizea rv' y xfdca. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); dc y xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4643 deviceMemory userSizea rv' y xfdca regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y xfdca) (?y4637 deviceMemory userSizea rv' y xfdca) (2 ^ unat userSizea)) \<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4641 deviceMemory userSizea rv' y xfdca rv (xfdc s)}
 4. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4599 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject (unat userSizea) \<lbrace>\<lambda>a b. ((\<lambda>a. unat userSizea + 4 = unat userSizea + 4) and ?R4647 deviceMemory userSizea rv' a b) b\<rbrace>
 5. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4597 deviceMemory userSizea rv') Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> \<lbrace>h_t_array_valid (hrs_htd \<acute>t_hrs) (cte_Ptr regionBase) (2 ^ unat userSizea)\<rbrace> \<inter> ?R'4643 deviceMemory userSizea rv' y (xfdc s) regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y (xfdc s)) (?y4637 deviceMemory userSizea rv' y (xfdc s)) (2 ^ unat userSizea)}
 6. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (unat userSizea + cteSizeBits) and (\<lambda>s. 2 ^ (unat userSizea + cteSizeBits) \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + cteSizeBits)}) and K (regionBase \<noteq> 0 \<and> range_cover regionBase (unat userSizea + cteSizeBits) (unat userSizea + cteSizeBits) 1 \<and> {regionBase..+2 ^ (unat userSizea + cteSizeBits)} \<inter> kernel_data_refs = {}) and ?R4599 deviceMemory userSizea) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0} \<inter> ?R'4597 deviceMemory userSizea ()}
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 9. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 10. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})}
flex-flex pairs:
\<lambda>deviceMemory userSizea rv' y xfdc a. ?R4649 deviceMemory userSizea rv' y xfdc regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y xfdc) (?y4637 deviceMemory userSizea rv' y xfdc) \<equiv>\<^sup>? \<lambda>deviceMemory userSizea rv' y xfdc. ?R4647 deviceMemory userSizea rv' y proof (prove)
goal (12 subgoals):
 1. \<And>deviceMemory userSizea rv' y xfdca rv xfdc. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); dc y xfdca; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q4641 deviceMemory userSizea rv' y xfdca rv) (?Q'4685 deviceMemory userSizea rv' y xfdca rv xfdc) [SKIP] (return (capability.CNodeCap regionBase (unat userSizea) 0 0)) (return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>deviceMemory userSizea rv' y xfdca rv xfdc. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); dc y xfdca; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4641 deviceMemory userSizea rv' y xfdca rv xfdc) \<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase) (?Q'4685 deviceMemory userSizea rv' y xfdca rv xfdc)
 3. \<And>deviceMemory userSizea rv' y xfdca rv xfdc s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); dc y xfdca; dc rv xfdc; ?Q4641 deviceMemory userSizea rv' y xfdca rv s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4641 deviceMemory userSizea rv' y xfdca rv xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase) {s'. (s, s') \<in> rf_sr}
 4. \<And>deviceMemory userSizea rv' y xfdc. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4649 deviceMemory userSizea rv' y xfdc regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y xfdc) (?y4637 deviceMemory userSizea rv' y xfdc)\<rbrace> modify (gsCNodes_update (\<lambda>a b. if b = regionBase then Some (unat userSizea) else a b)) \<lbrace>?Q4641 deviceMemory userSizea rv' y xfdc\<rbrace>
 5. \<And>deviceMemory userSizea rv' y xfdca. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); dc y xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4643 deviceMemory userSizea rv' y xfdca regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y xfdca) (?y4637 deviceMemory userSizea rv' y xfdca) (2 ^ unat userSizea)) \<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4641 deviceMemory userSizea rv' y xfdca rv (xfdc s)}
 6. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4599 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject (unat userSizea) \<lbrace>\<lambda>a b. ((\<lambda>a. unat userSizea + 4 = unat userSizea + 4) and ?R4647 deviceMemory userSizea rv' a b) b\<rbrace>
 7. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4597 deviceMemory userSizea rv') Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> \<lbrace>h_t_array_valid (hrs_htd \<acute>t_hrs) (cte_Ptr regionBase) (2 ^ unat userSizea)\<rbrace> \<inter> ?R'4643 deviceMemory userSizea rv' y (xfdc s) regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y (xfdc s)) (?y4637 deviceMemory userSizea rv' y (xfdc s)) (2 ^ unat userSizea)}
 8. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (unat userSizea + cteSizeBits) and (\<lambda>s. 2 ^ (unat userSizea + cteSizeBits) \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + cteSizeBits)}) and K (regionBase \<noteq> 0 \<and> range_cover regionBase (unat userSizea + cteSizeBits) (unat userSizea + cteSizeBits) 1 \<and> {regionBase..+2 ^ (unat userSizea + cteSizeBits)} \<inter> kernel_data_refs = {}) and ?R4599 deviceMemory userSizea) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0} \<inter> ?R'4597 deviceMemory userSizea ()}
 9. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 10. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>deviceMemory userSizea rv' y xfdc a. ?R4649 deviceMemory userSizea rv' y xfdc regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y xfdc) (?y4637 deviceMemory userSizea rv' y xfdc) \<equiv>\<^sup>? \<lambda>deviceMemory userSizea rv' y xfdc. ?R4647 deviceMemory userSizea rv' y proof (prove)
goal (11 subgoals):
 1. \<And>deviceMemory userSizea rv' y xfdca rv xfdc. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); dc y xfdca; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4641 deviceMemory userSizea rv' y xfdca rv xfdc) \<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase) \<lbrace>ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) \<acute>ret__struct_cap_C\<rbrace>
 2. \<And>deviceMemory userSizea rv' y xfdca rv xfdc s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); dc y xfdca; dc rv xfdc; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4641 deviceMemory userSizea rv' y xfdca rv xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase) {s'. (s, s') \<in> rf_sr}
 3. \<And>deviceMemory userSizea rv' y xfdc. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4649 deviceMemory userSizea rv' y xfdc regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y xfdc) (?y4637 deviceMemory userSizea rv' y xfdc)\<rbrace> modify (gsCNodes_update (\<lambda>a b. if b = regionBase then Some (unat userSizea) else a b)) \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>deviceMemory userSizea rv' y xfdca. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); dc y xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4643 deviceMemory userSizea rv' y xfdca regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y xfdca) (?y4637 deviceMemory userSizea rv' y xfdca) (2 ^ unat userSizea)) \<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4641 deviceMemory userSizea rv' y xfdca rv (xfdc s)}
 5. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4599 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject (unat userSizea) \<lbrace>\<lambda>a b. ((\<lambda>a. unat userSizea + 4 = unat userSizea + 4) and ?R4647 deviceMemory userSizea rv' a b) b\<rbrace>
 6. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4597 deviceMemory userSizea rv') Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> \<lbrace>h_t_array_valid (hrs_htd \<acute>t_hrs) (cte_Ptr regionBase) (2 ^ unat userSizea)\<rbrace> \<inter> ?R'4643 deviceMemory userSizea rv' y (xfdc s) regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y (xfdc s)) (?y4637 deviceMemory userSizea rv' y (xfdc s)) (2 ^ unat userSizea)}
 7. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (unat userSizea + cteSizeBits) and (\<lambda>s. 2 ^ (unat userSizea + cteSizeBits) \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + cteSizeBits)}) and K (regionBase \<noteq> 0 \<and> range_cover regionBase (unat userSizea + cteSizeBits) (unat userSizea + cteSizeBits) 1 \<and> {regionBase..+2 ^ (unat userSizea + cteSizeBits)} \<inter> kernel_data_refs = {}) and ?R4599 deviceMemory userSizea) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0} \<inter> ?R'4597 deviceMemory userSizea ()}
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 9. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 10. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
A total of 11 subgoals...
flex-flex pairs:
\<lambda>deviceMemory userSizea rv' y xfdc a. ?R4649 deviceMemory userSizea rv' y xfdc regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y xfdc) (?y4637 deviceMemory userSizea rv' y xfdc) \<equiv>\<^sup>? \<lambda>deviceMemory userSizea rv' y xfdc. ?R4647 deviceMemory userSizea rv' y proof (prove)
goal (10 subgoals):
 1. \<And>deviceMemory userSizea rv' y xfdca rv xfdc s. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); dc y xfdca; dc rv xfdc; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<forall>t. cap_cnode_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0 && mask 5, capCNodeGuard_CL = 0 && mask 18, capCNodePtr_CL = regionBase && ~~ mask 5\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__struct_cap_C :== CALL cap_cnode_cap_new_'proc(userSizea,0,0,regionBase) {s'. (s, s') \<in> rf_sr}
 2. \<And>deviceMemory userSizea rv' y xfdc. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4649 deviceMemory userSizea rv' y xfdc regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y xfdc) (?y4637 deviceMemory userSizea rv' y xfdc)\<rbrace> modify (gsCNodes_update (\<lambda>a b. if b = regionBase then Some (unat userSizea) else a b)) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>deviceMemory userSizea rv' y xfdca. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); dc y xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4643 deviceMemory userSizea rv' y xfdca regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y xfdca) (?y4637 deviceMemory userSizea rv' y xfdca) (2 ^ unat userSizea)) \<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> \<lbrace>\<forall>t. cap_cnode_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0 && mask 5, capCNodeGuard_CL = 0 && mask 18, capCNodePtr_CL = regionBase && ~~ mask 5\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>}
 4. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4599 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject (unat userSizea) \<lbrace>\<lambda>a b. ((\<lambda>a. unat userSizea + 4 = unat userSizea + 4) and ?R4647 deviceMemory userSizea rv' a b) b\<rbrace>
 5. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4597 deviceMemory userSizea rv') Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> \<lbrace>h_t_array_valid (hrs_htd \<acute>t_hrs) (cte_Ptr regionBase) (2 ^ unat userSizea)\<rbrace> \<inter> ?R'4643 deviceMemory userSizea rv' y (xfdc s) regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y (xfdc s)) (?y4637 deviceMemory userSizea rv' y (xfdc s)) (2 ^ unat userSizea)}
 6. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (unat userSizea + cteSizeBits) and (\<lambda>s. 2 ^ (unat userSizea + cteSizeBits) \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + cteSizeBits)}) and K (regionBase \<noteq> 0 \<and> range_cover regionBase (unat userSizea + cteSizeBits) (unat userSizea + cteSizeBits) 1 \<and> {regionBase..+2 ^ (unat userSizea + cteSizeBits)} \<inter> kernel_data_refs = {}) and ?R4599 deviceMemory userSizea) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0} \<inter> ?R'4597 deviceMemory userSizea ()}
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 8. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 9. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 10. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})}
flex-flex pairs:
\<lambda>deviceMemory userSizea rv' y xfdc a. ?R4649 deviceMemory userSizea rv' y xfdc regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y xfdc) (?y4637 deviceMemory userSizea rv' y xfdc) \<equiv>\<^sup>? \<lambda>deviceMemory userSizea rv' y xfdc. ?R4647 deviceMemory userSizea rv' y proof (prove)
goal (9 subgoals):
 1. \<And>deviceMemory userSizea rv' y xfdc. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); dc y xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R4649 deviceMemory userSizea rv' y xfdc regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y xfdc) (?y4637 deviceMemory userSizea rv' y xfdc)\<rbrace> modify (gsCNodes_update (\<lambda>a b. if b = regionBase then Some (unat userSizea) else a b)) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>deviceMemory userSizea rv' y xfdca. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); dc y xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4643 deviceMemory userSizea rv' y xfdca regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y xfdca) (?y4637 deviceMemory userSizea rv' y xfdca) (2 ^ unat userSizea)) \<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> \<lbrace>\<forall>t. cap_cnode_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0 && mask 5, capCNodeGuard_CL = 0 && mask 18, capCNodePtr_CL = regionBase && ~~ mask 5\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>}
 3. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4599 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject (unat userSizea) \<lbrace>\<lambda>a b. ((\<lambda>a. unat userSizea + 4 = unat userSizea + 4) and ?R4647 deviceMemory userSizea rv' a b) b\<rbrace>
 4. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4597 deviceMemory userSizea rv') Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> \<lbrace>h_t_array_valid (hrs_htd \<acute>t_hrs) (cte_Ptr regionBase) (2 ^ unat userSizea)\<rbrace> \<inter> ?R'4643 deviceMemory userSizea rv' y (xfdc s) regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y (xfdc s)) (?y4637 deviceMemory userSizea rv' y (xfdc s)) (2 ^ unat userSizea)}
 5. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (unat userSizea + cteSizeBits) and (\<lambda>s. 2 ^ (unat userSizea + cteSizeBits) \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + cteSizeBits)}) and K (regionBase \<noteq> 0 \<and> range_cover regionBase (unat userSizea + cteSizeBits) (unat userSizea + cteSizeBits) 1 \<and> {regionBase..+2 ^ (unat userSizea + cteSizeBits)} \<inter> kernel_data_refs = {}) and ?R4599 deviceMemory userSizea) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0} \<inter> ?R'4597 deviceMemory userSizea ()}
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 7. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 8. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 9. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})}
flex-flex pairs:
\<lambda>deviceMemory userSizea rv' y xfdc a. ?R4649 deviceMemory userSizea rv' y xfdc regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y xfdc) (?y4637 deviceMemory userSizea rv' y xfdc) \<equiv>\<^sup>? \<lambda>deviceMemory userSizea rv' y xfdc. ?R4647 deviceMemory userSizea rv' y proof (prove)
goal (8 subgoals):
 1. \<And>deviceMemory userSizea rv' y xfdca. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); dc y xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4643 deviceMemory userSizea rv' y xfdca regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y xfdca) (?y4637 deviceMemory userSizea rv' y xfdca) (2 ^ unat userSizea)) \<acute>globals :== ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> \<lbrace>\<forall>t. cap_cnode_cap_lift \<^bsup>t\<^esup>ret__struct_cap_C = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0 && mask 5, capCNodeGuard_CL = 0 && mask 18, capCNodePtr_CL = regionBase && ~~ mask 5\<rparr> \<and> cap_get_tag \<^bsup>t\<^esup>ret__struct_cap_C = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) \<^bsup>t\<^esup>ret__struct_cap_C\<rbrace>}
 2. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4599 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject (unat userSizea) \<lbrace>\<lambda>a. (\<lambda>a. unat userSizea + 4 = unat userSizea + 4) and (\<lambda>a. True)\<rbrace>
 3. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4597 deviceMemory userSizea rv') Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> \<lbrace>h_t_array_valid (hrs_htd \<acute>t_hrs) (cte_Ptr regionBase) (2 ^ unat userSizea)\<rbrace> \<inter> ?R'4643 deviceMemory userSizea rv' y (xfdc s) regionBase userSizea (?rv'4637 deviceMemory userSizea rv' y (xfdc s)) (?y4637 deviceMemory userSizea rv' y (xfdc s)) (2 ^ unat userSizea)}
 4. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (unat userSizea + cteSizeBits) and (\<lambda>s. 2 ^ (unat userSizea + cteSizeBits) \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + cteSizeBits)}) and K (regionBase \<noteq> 0 \<and> range_cover regionBase (unat userSizea + cteSizeBits) (unat userSizea + cteSizeBits) 1 \<and> {regionBase..+2 ^ (unat userSizea + cteSizeBits)} \<inter> kernel_data_refs = {}) and ?R4599 deviceMemory userSizea) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0} \<inter> ?R'4597 deviceMemory userSizea ()}
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 6. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 7. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 8. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (7 subgoals):
 1. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> \<lbrace>?R4599 deviceMemory userSizea\<rbrace> placeNewObject regionBase makeObject (unat userSizea) \<lbrace>\<lambda>a. (\<lambda>a. unat userSizea + 4 = unat userSizea + 4) and (\<lambda>a. True)\<rbrace>
 2. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4597 deviceMemory userSizea rv') Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> \<lbrace>h_t_array_valid (hrs_htd \<acute>t_hrs) (cte_Ptr regionBase) (2 ^ unat userSizea)\<rbrace> \<inter> {s. \<forall>rv. dc rv (xfdc (globals_update (ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4))) s)) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0 && mask 5, capCNodeGuard_CL = 0 && mask 18, capCNodePtr_CL = regionBase && ~~ mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) (ret__struct_cap_C_' t))}}
 3. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (unat userSizea + cteSizeBits) and (\<lambda>s. 2 ^ (unat userSizea + cteSizeBits) \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + cteSizeBits)}) and K (regionBase \<noteq> 0 \<and> range_cover regionBase (unat userSizea + cteSizeBits) (unat userSizea + cteSizeBits) 1 \<and> {regionBase..+2 ^ (unat userSizea + cteSizeBits)} \<inter> kernel_data_refs = {}) and ?R4599 deviceMemory userSizea) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0} \<inter> ?R'4597 deviceMemory userSizea ()}
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 5. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 6. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 7. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea rv'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4597 deviceMemory userSizea rv') Guard MemorySafety \<lbrace>htd_safe domain (hrs_htd \<acute>t_hrs) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd \<acute>t_hrs))\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)))) {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> \<lbrace>h_t_array_valid (hrs_htd \<acute>t_hrs) (cte_Ptr regionBase) (2 ^ unat userSizea)\<rbrace> \<inter> {s. \<forall>rv. dc rv (xfdc (globals_update (ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4))) s)) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0 && mask 5, capCNodeGuard_CL = 0 && mask 18, capCNodePtr_CL = regionBase && ~~ mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) (ret__struct_cap_C_' t))}}
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (unat userSizea + cteSizeBits) and (\<lambda>s. 2 ^ (unat userSizea + cteSizeBits) \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + cteSizeBits)}) and K (regionBase \<noteq> 0 \<and> range_cover regionBase (unat userSizea + cteSizeBits) (unat userSizea + cteSizeBits) 1 \<and> {regionBase..+2 ^ (unat userSizea + cteSizeBits)} \<inter> kernel_data_refs = {}) and (\<lambda>a. unat userSizea + 4 = unat userSizea + 4 \<and> True)) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0} \<inter> ?R'4597 deviceMemory userSizea ()}
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (unat userSizea + cteSizeBits) and (\<lambda>s. 2 ^ (unat userSizea + cteSizeBits) \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + cteSizeBits)}) and K (regionBase \<noteq> 0 \<and> range_cover regionBase (unat userSizea + cteSizeBits) (unat userSizea + cteSizeBits) 1 \<and> {regionBase..+2 ^ (unat userSizea + cteSizeBits)} \<inter> kernel_data_refs = {}) and (\<lambda>a. unat userSizea + 4 = unat userSizea + 4 \<and> True)) s \<and> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0} \<inter> {s. htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> (\<forall>y. dc y (xfdc (globals_update (t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)))) s)) \<longrightarrow> h_t_array_valid (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) (t_hrs_' (globals s)))) (cte_Ptr regionBase) (2 ^ unat userSizea) \<and> (\<forall>rv. dc rv (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4)) (t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))) x)) s)) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0 && mask 5, capCNodeGuard_CL = 0 && mask 18, capCNodePtr_CL = regionBase && ~~ mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) (ret__struct_cap_C_' t))))}}
 2. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 4. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 5. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and pspace_no_overlap' regionBase (unat userSizea + cteSizeBits) and (\<lambda>s. 2 ^ (unat userSizea + cteSizeBits) \<le> gsMaxObjectSize s) and (valid_objs' and untyped_ranges_zero' and caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + cteSizeBits)}) and K (regionBase \<noteq> 0 \<and> range_cover regionBase (unat userSizea + cteSizeBits) (unat userSizea + cteSizeBits) 1 \<and> {regionBase..+2 ^ (unat userSizea + cteSizeBits)} \<inter> kernel_data_refs = {}) and (\<lambda>a. unat userSizea + 4 = unat userSizea + 4 \<and> True)) s
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0} \<inter> {s. htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> (\<forall>y. dc y (xfdc (globals_update (t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)))) s)) \<longrightarrow> h_t_array_valid (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) (t_hrs_' (globals s)))) (cte_Ptr regionBase) (2 ^ unat userSizea) \<and> (\<forall>rv. dc rv (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4)) (t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))) x)) s)) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0 && mask 5, capCNodeGuard_CL = 0 && mask 18, capCNodePtr_CL = regionBase && ~~ mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) (ret__struct_cap_C_' t))))}}
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ (objBits makeObject + unat userSizea)) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (objBits makeObject + unat userSizea)) regionBase = replicate (2 ^ (objBits makeObject + unat userSizea)) 0; pspace_no_overlap' regionBase (objBits makeObject + unat userSizea) s; caps_overlap_reserved' {regionBase..+2 ^ (objBits makeObject + unat userSizea)} s; 2 ^ (objBits makeObject + unat userSizea) \<le> gsMaxObjectSize s; {regionBase..+2 ^ (objBits makeObject + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject + unat userSizea) (objBits makeObject + unat userSizea) (Suc 0)\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' regionBase (unat userSizea + cteSizeBits) s \<and> 2 ^ (unat userSizea + cteSizeBits) \<le> gsMaxObjectSize s \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + cteSizeBits)} s \<and> range_cover regionBase (unat userSizea + cteSizeBits) (unat userSizea + cteSizeBits) (Suc 0) \<and> {regionBase..+2 ^ (unat userSizea + cteSizeBits)} \<inter> kernel_data_refs = {}
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0} \<inter> {s. htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> (\<forall>y. dc y (xfdc (globals_update (t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)))) s)) \<longrightarrow> h_t_array_valid (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) (t_hrs_' (globals s)))) (cte_Ptr regionBase) (2 ^ unat userSizea) \<and> (\<forall>rv. dc rv (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4)) (t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))) x)) s)) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0 && mask 5, capCNodeGuard_CL = 0 && mask 18, capCNodePtr_CL = regionBase && ~~ mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) (ret__struct_cap_C_' t))))}}
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ (objBits makeObject + unat userSizea)) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (objBits makeObject + unat userSizea)) regionBase = replicate (2 ^ (objBits makeObject + unat userSizea)) 0; pspace_no_overlap' regionBase (objBits makeObject + unat userSizea) s; caps_overlap_reserved' {regionBase..+2 ^ (objBits makeObject + unat userSizea)} s; 2 ^ (objBits makeObject + unat userSizea) \<le> gsMaxObjectSize s; {regionBase..+2 ^ (objBits makeObject + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject + unat userSizea) (objBits makeObject + unat userSizea) (Suc 0); pspace_aligned' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' regionBase (unat userSizea + cteSizeBits) s \<and> 2 ^ (unat userSizea + cteSizeBits) \<le> gsMaxObjectSize s \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + cteSizeBits)} s \<and> range_cover regionBase (unat userSizea + cteSizeBits) (unat userSizea + cteSizeBits) (Suc 0) \<and> {regionBase..+2 ^ (unat userSizea + cteSizeBits)} \<inter> kernel_data_refs = {}
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0} \<inter> {s. htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> (\<forall>y. dc y (xfdc (globals_update (t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)))) s)) \<longrightarrow> h_t_array_valid (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) (t_hrs_' (globals s)))) (cte_Ptr regionBase) (2 ^ unat userSizea) \<and> (\<forall>rv. dc rv (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4)) (t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))) x)) s)) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0 && mask 5, capCNodeGuard_CL = 0 && mask 18, capCNodePtr_CL = regionBase && ~~ mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) (ret__struct_cap_C_' t))))}}
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ (objBits makeObject + unat userSizea)) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (objBits makeObject + unat userSizea)) regionBase = replicate (2 ^ (objBits makeObject + unat userSizea)) 0; pspace_no_overlap' regionBase (objBits makeObject + unat userSizea) s; caps_overlap_reserved' {regionBase..+2 ^ (objBits makeObject + unat userSizea)} s; 2 ^ (objBits makeObject + unat userSizea) \<le> gsMaxObjectSize s; {regionBase..+2 ^ (objBits makeObject + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject + unat userSizea) (objBits makeObject + unat userSizea) (Suc 0); pspace_aligned' s; pspace_distinct' s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' regionBase (unat userSizea + cteSizeBits) s \<and> 2 ^ (unat userSizea + cteSizeBits) \<le> gsMaxObjectSize s \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + cteSizeBits)} s \<and> range_cover regionBase (unat userSizea + cteSizeBits) (unat userSizea + cteSizeBits) (Suc 0) \<and> {regionBase..+2 ^ (unat userSizea + cteSizeBits)} \<inter> kernel_data_refs = {}
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0} \<inter> {s. htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> (\<forall>y. dc y (xfdc (globals_update (t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)))) s)) \<longrightarrow> h_t_array_valid (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) (t_hrs_' (globals s)))) (cte_Ptr regionBase) (2 ^ unat userSizea) \<and> (\<forall>rv. dc rv (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4)) (t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))) x)) s)) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0 && mask 5, capCNodeGuard_CL = 0 && mask 18, capCNodePtr_CL = regionBase && ~~ mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) (ret__struct_cap_C_' t))))}}
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ (objBits makeObject + unat userSizea)) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (objBits makeObject + unat userSizea)) regionBase = replicate (2 ^ (objBits makeObject + unat userSizea)) 0; pspace_no_overlap' regionBase (objBits makeObject + unat userSizea) s; caps_overlap_reserved' {regionBase..+2 ^ (objBits makeObject + unat userSizea)} s; 2 ^ (objBits makeObject + unat userSizea) \<le> gsMaxObjectSize s; {regionBase..+2 ^ (objBits makeObject + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject + unat userSizea) (objBits makeObject + unat userSizea) (Suc 0); pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' regionBase (unat userSizea + cteSizeBits) s \<and> 2 ^ (unat userSizea + cteSizeBits) \<le> gsMaxObjectSize s \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + cteSizeBits)} s \<and> range_cover regionBase (unat userSizea + cteSizeBits) (unat userSizea + cteSizeBits) (Suc 0) \<and> {regionBase..+2 ^ (unat userSizea + cteSizeBits)} \<inter> kernel_data_refs = {}
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0} \<inter> {s. htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> (\<forall>y. dc y (xfdc (globals_update (t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)))) s)) \<longrightarrow> h_t_array_valid (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) (t_hrs_' (globals s)))) (cte_Ptr regionBase) (2 ^ unat userSizea) \<and> (\<forall>rv. dc rv (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4)) (t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))) x)) s)) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0 && mask 5, capCNodeGuard_CL = 0 && mask 18, capCNodePtr_CL = regionBase && ~~ mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) (ret__struct_cap_C_' t))))}}
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ (objBits makeObject + unat userSizea)) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (objBits makeObject + unat userSizea)) regionBase = replicate (2 ^ (objBits makeObject + unat userSizea)) 0; pspace_no_overlap' regionBase (objBits makeObject + unat userSizea) s; caps_overlap_reserved' {regionBase..+2 ^ (objBits makeObject + unat userSizea)} s; 2 ^ (objBits makeObject + unat userSizea) \<le> gsMaxObjectSize s; {regionBase..+2 ^ (objBits makeObject + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject + unat userSizea) (objBits makeObject + unat userSizea) (Suc 0); pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s)\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' regionBase (unat userSizea + cteSizeBits) s \<and> 2 ^ (unat userSizea + cteSizeBits) \<le> gsMaxObjectSize s \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + cteSizeBits)} s \<and> range_cover regionBase (unat userSizea + cteSizeBits) (unat userSizea + cteSizeBits) (Suc 0) \<and> {regionBase..+2 ^ (unat userSizea + cteSizeBits)} \<inter> kernel_data_refs = {}
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0} \<inter> {s. htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> (\<forall>y. dc y (xfdc (globals_update (t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)))) s)) \<longrightarrow> h_t_array_valid (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) (t_hrs_' (globals s)))) (cte_Ptr regionBase) (2 ^ unat userSizea) \<and> (\<forall>rv. dc rv (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4)) (t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))) x)) s)) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0 && mask 5, capCNodeGuard_CL = 0 && mask 18, capCNodePtr_CL = regionBase && ~~ mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) (ret__struct_cap_C_' t))))}}
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ (objBits makeObject + unat userSizea)) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (objBits makeObject + unat userSizea)) regionBase = replicate (2 ^ (objBits makeObject + unat userSizea)) 0; pspace_no_overlap' regionBase (objBits makeObject + unat userSizea) s; caps_overlap_reserved' {regionBase..+2 ^ (objBits makeObject + unat userSizea)} s; 2 ^ (objBits makeObject + unat userSizea) \<le> gsMaxObjectSize s; {regionBase..+2 ^ (objBits makeObject + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject + unat userSizea) (objBits makeObject + unat userSizea) (Suc 0); pspace_aligned' s; pspace_distinct' s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s')) = 0 \<or> word_of_nat (2 ^ (objBits makeObject + unat userSizea)) \<le> gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s'))\<rbrakk> \<Longrightarrow> pspace_aligned' s \<and> pspace_distinct' s \<and> pspace_no_overlap' regionBase (unat userSizea + cteSizeBits) s \<and> 2 ^ (unat userSizea + cteSizeBits) \<le> gsMaxObjectSize s \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + cteSizeBits)} s \<and> range_cover regionBase (unat userSizea + cteSizeBits) (unat userSizea + cteSizeBits) (Suc 0) \<and> {regionBase..+2 ^ (unat userSizea + cteSizeBits)} \<inter> kernel_data_refs = {}
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0} \<inter> {s. htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> (\<forall>y. dc y (xfdc (globals_update (t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)))) s)) \<longrightarrow> h_t_array_valid (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) (t_hrs_' (globals s)))) (cte_Ptr regionBase) (2 ^ unat userSizea) \<and> (\<forall>rv. dc rv (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4)) (t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))) x)) s)) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0 && mask 5, capCNodeGuard_CL = 0 && mask 18, capCNodePtr_CL = regionBase && ~~ mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) (ret__struct_cap_C_' t))))}}
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> isFrameType (APIObjectType ArchTypes_H.apiobject_type.CapTableObject); (s, s') \<in> rf_sr; createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) isdev s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s' \<in> {s. s \<in> {s. region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0} \<inter> {s. htd_safe domain (hrs_htd (t_hrs_' (globals s))) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s)))) \<longrightarrow> (\<forall>y. dc y (xfdc (globals_update (t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)))) s)) \<longrightarrow> h_t_array_valid (hrs_htd (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase)) (t_hrs_' (globals s)))) (cte_Ptr regionBase) (2 ^ unat userSizea) \<and> (\<forall>rv. dc rv (xfdc (globals_update (\<lambda>x. ghost'state_'_update (gs_new_cnodes (unat userSizea) regionBase (unat userSizea + 4)) (t_hrs_'_update (hrs_htd_update (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase))) x)) s)) \<longrightarrow> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0 && mask 5, capCNodeGuard_CL = 0 && mask 18, capCNodePtr_CL = regionBase && ~~ mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) (ret__struct_cap_C_' t))))}}
 2. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 4. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 5. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ (objBits makeObject + unat userSizea)) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (objBits makeObject + unat userSizea)) regionBase = replicate (2 ^ (objBits makeObject + unat userSizea)) 0; pspace_no_overlap' regionBase (objBits makeObject + unat userSizea) s; caps_overlap_reserved' {regionBase..+2 ^ (objBits makeObject + unat userSizea)} s; 2 ^ (objBits makeObject + unat userSizea) \<le> gsMaxObjectSize s; {regionBase..+2 ^ (objBits makeObject + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject + unat userSizea) (objBits makeObject + unat userSizea) (Suc 0)\<rbrakk> \<Longrightarrow> region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s')))) \<longrightarrow> h_t_array_valid (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s')))) (cte_Ptr regionBase) (2 ^ unat userSizea) \<and> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0, capCNodeGuard_CL = 0, capCNodePtr_CL = regionBase && ~~ mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) (ret__struct_cap_C_' t)))
 2. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 4. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 5. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ (objBits makeObject + unat userSizea)) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (objBits makeObject + unat userSizea)) regionBase = replicate (2 ^ (objBits makeObject + unat userSizea)) 0; pspace_no_overlap' regionBase (objBits makeObject + unat userSizea) s; caps_overlap_reserved' {regionBase..+2 ^ (objBits makeObject + unat userSizea)} s; 2 ^ (objBits makeObject + unat userSizea) \<le> gsMaxObjectSize s; {regionBase..+2 ^ (objBits makeObject + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject + unat userSizea) (objBits makeObject + unat userSizea) (Suc 0); 2 ^ (cteSizeBits + unat userSizea) < addr_card\<rbrakk> \<Longrightarrow> region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s')))) \<longrightarrow> h_t_array_valid (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s')))) (cte_Ptr regionBase) (2 ^ unat userSizea) \<and> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0, capCNodeGuard_CL = 0, capCNodePtr_CL = regionBase && ~~ mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) (ret__struct_cap_C_' t)))
 2. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 4. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 5. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ (objBits makeObject + unat userSizea)) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (objBits makeObject + unat userSizea)) regionBase = replicate (2 ^ (objBits makeObject + unat userSizea)) 0; pspace_no_overlap' regionBase (objBits makeObject + unat userSizea) s; caps_overlap_reserved' {regionBase..+2 ^ (objBits makeObject + unat userSizea)} s; 2 ^ (objBits makeObject + unat userSizea) \<le> gsMaxObjectSize s; {regionBase..+2 ^ (objBits makeObject + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject + unat userSizea) (objBits makeObject + unat userSizea) (Suc 0); 2 ^ (cteSizeBits + unat userSizea) < addr_card\<rbrakk> \<Longrightarrow> 2 ^ unat userSizea * size_of TYPE(cte_C) < addr_card
 2. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ (objBits makeObject + unat userSizea)) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (objBits makeObject + unat userSizea)) regionBase = replicate (2 ^ (objBits makeObject + unat userSizea)) 0; pspace_no_overlap' regionBase (objBits makeObject + unat userSizea) s; caps_overlap_reserved' {regionBase..+2 ^ (objBits makeObject + unat userSizea)} s; 2 ^ (objBits makeObject + unat userSizea) \<le> gsMaxObjectSize s; {regionBase..+2 ^ (objBits makeObject + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject + unat userSizea) (objBits makeObject + unat userSizea) (Suc 0); 2 ^ (cteSizeBits + unat userSizea) < addr_card\<rbrakk> \<Longrightarrow> region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s')))) \<longrightarrow> True \<and> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0, capCNodeGuard_CL = 0, capCNodePtr_CL = regionBase && ~~ mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) (ret__struct_cap_C_' t)))
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ (objBits makeObject + unat userSizea)) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (objBits makeObject + unat userSizea)) regionBase = replicate (2 ^ (objBits makeObject + unat userSizea)) 0; pspace_no_overlap' regionBase (objBits makeObject + unat userSizea) s; caps_overlap_reserved' {regionBase..+2 ^ (objBits makeObject + unat userSizea)} s; 2 ^ (objBits makeObject + unat userSizea) \<le> gsMaxObjectSize s; {regionBase..+2 ^ (objBits makeObject + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject + unat userSizea) (objBits makeObject + unat userSizea) (Suc 0); 2 ^ (cteSizeBits + unat userSizea) < addr_card\<rbrakk> \<Longrightarrow> region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s')))) \<longrightarrow> True \<and> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0, capCNodeGuard_CL = 0, capCNodePtr_CL = regionBase && ~~ mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) (ret__struct_cap_C_' t)))
 2. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 4. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 5. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemory userSizea s s'. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (cteSizeBits + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (cteSizeBits + unat userSizea) (cteSizeBits + unat userSizea) (Suc 0); unat userSizea < 28; 0 < unat userSizea; \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ (objBits makeObject + unat userSizea)) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (objBits makeObject + unat userSizea)) regionBase = replicate (2 ^ (objBits makeObject + unat userSizea)) 0; pspace_no_overlap' regionBase (objBits makeObject + unat userSizea) s; caps_overlap_reserved' {regionBase..+2 ^ (objBits makeObject + unat userSizea)} s; 2 ^ (objBits makeObject + unat userSizea) \<le> gsMaxObjectSize s; {regionBase..+2 ^ (objBits makeObject + unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (objBits makeObject + unat userSizea) (objBits makeObject + unat userSizea) (Suc 0); 2 ^ (cteSizeBits + unat userSizea) < addr_card; is_aligned regionBase (cteSizeBits + unat userSizea)\<rbrakk> \<Longrightarrow> region_actually_is_bytes regionBase (2 ^ (unat userSizea + cteSizeBits)) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (unat userSizea + cteSizeBits)) regionBase = replicate (2 ^ (unat userSizea + cteSizeBits)) 0 \<and> (htd_safe domain (hrs_htd (t_hrs_' (globals s'))) \<and> htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s')))) \<longrightarrow> True \<and> (\<forall>t. cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0, capCNodeGuard_CL = 0, capCNodePtr_CL = regionBase && ~~ mask 5\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> ccap_relation (capability.CNodeCap regionBase (unat userSizea) 0 0) (ret__struct_cap_C_' t)))
 2. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 4. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 5. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemory userSizea s s' t. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (unat userSizea + 4)} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea + 4) (unat userSizea + 4) (Suc 0); unat userSizea < 28; 0 < unat userSizea; \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ (unat userSizea + 4)) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (unat userSizea + 4)) regionBase = replicate (2 ^ (unat userSizea + 4)) 0; pspace_no_overlap' regionBase (unat userSizea + 4) s; caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + 4)} s; 2 ^ (unat userSizea + 4) \<le> gsMaxObjectSize s; unat userSizea + 4 < word_bits; is_aligned regionBase (unat userSizea + 4); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s')))); cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0, capCNodeGuard_CL = 0, capCNodePtr_CL = regionBase\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_cnode_cap \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0, capCNodeGuard_CL = 0, capCNodePtr_CL = regionBase\<rparr>)\<rbrakk> \<Longrightarrow> userSizea = userSizea && mask 5
 2. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 4. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 5. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea s s' t. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (unat userSizea + 4)} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea + 4) (unat userSizea + 4) (Suc 0); unat userSizea < 28; 0 < unat userSizea; \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ (unat userSizea + 4)) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (unat userSizea + 4)) regionBase = replicate (2 ^ (unat userSizea + 4)) 0; pspace_no_overlap' regionBase (unat userSizea + 4) s; caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + 4)} s; 2 ^ (unat userSizea + 4) \<le> gsMaxObjectSize s; unat userSizea + 4 < word_bits; is_aligned regionBase (unat userSizea + 4); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s')))); cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0, capCNodeGuard_CL = 0, capCNodePtr_CL = regionBase\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_cnode_cap \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0, capCNodeGuard_CL = 0, capCNodePtr_CL = regionBase\<rparr>)\<rbrakk> \<Longrightarrow> userSizea \<le> mask 5
 2. \<And>deviceMemory userSizea s s' t. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (unat userSizea + 4)} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea + 4) (unat userSizea + 4) (Suc 0); unat userSizea < 28; 0 < unat userSizea; \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ (unat userSizea + 4)) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (unat userSizea + 4)) regionBase = replicate (2 ^ (unat userSizea + 4)) 0; pspace_no_overlap' regionBase (unat userSizea + 4) s; caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + 4)} s; 2 ^ (unat userSizea + 4) \<le> gsMaxObjectSize s; unat userSizea + 4 < word_bits; is_aligned regionBase (unat userSizea + 4); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s')))); cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0, capCNodeGuard_CL = 0, capCNodePtr_CL = regionBase\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_cnode_cap \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0, capCNodeGuard_CL = 0, capCNodePtr_CL = regionBase\<rparr>)\<rbrakk> \<Longrightarrow> True
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (6 subgoals):
 1. \<And>deviceMemory userSizea s s' t. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (unat userSizea + 4)} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea + 4) (unat userSizea + 4) (Suc 0); unat userSizea < 28; 0 < unat userSizea; \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ (unat userSizea + 4)) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (unat userSizea + 4)) regionBase = replicate (2 ^ (unat userSizea + 4)) 0; pspace_no_overlap' regionBase (unat userSizea + 4) s; caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + 4)} s; 2 ^ (unat userSizea + 4) \<le> gsMaxObjectSize s; unat userSizea + 4 < word_bits; is_aligned regionBase (unat userSizea + 4); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s')))); cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && 0x1F, capCNodeGuardSize_CL = 0, capCNodeGuard_CL = 0, capCNodePtr_CL = regionBase\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_cnode_cap \<lparr>capCNodeRadix_CL = userSizea && 0x1F, capCNodeGuardSize_CL = 0, capCNodeGuard_CL = 0, capCNodePtr_CL = regionBase\<rparr>)\<rbrakk> \<Longrightarrow> userSizea \<le> 0x1F
 2. \<And>deviceMemory userSizea s s' t. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (unat userSizea + 4)} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea + 4) (unat userSizea + 4) (Suc 0); unat userSizea < 28; 0 < unat userSizea; \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ (unat userSizea + 4)) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (unat userSizea + 4)) regionBase = replicate (2 ^ (unat userSizea + 4)) 0; pspace_no_overlap' regionBase (unat userSizea + 4) s; caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + 4)} s; 2 ^ (unat userSizea + 4) \<le> gsMaxObjectSize s; unat userSizea + 4 < word_bits; is_aligned regionBase (unat userSizea + 4); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s')))); cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0, capCNodeGuard_CL = 0, capCNodePtr_CL = regionBase\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_cnode_cap \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0, capCNodeGuard_CL = 0, capCNodePtr_CL = regionBase\<rparr>)\<rbrakk> \<Longrightarrow> True
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 4. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 5. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 6. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (5 subgoals):
 1. \<And>deviceMemory userSizea s s' t. \<lbrakk>\<not> isdev; userSize = unat userSizea; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject; regionBase \<noteq> 0; {regionBase..+2 ^ (unat userSizea + 4)} \<inter> kernel_data_refs = {}; range_cover regionBase (unat userSizea + 4) (unat userSizea + 4) (Suc 0); unat userSizea < 28; 0 < unat userSizea; \<not> to_bool deviceMemory; (s, s') \<in> rf_sr; invs' s; region_actually_is_bytes regionBase (2 ^ (unat userSizea + 4)) s'; heap_list (hrs_mem (t_hrs_' (globals s'))) (2 ^ (unat userSizea + 4)) regionBase = replicate (2 ^ (unat userSizea + 4)) 0; pspace_no_overlap' regionBase (unat userSizea + 4) s; caps_overlap_reserved' {regionBase..+2 ^ (unat userSizea + 4)} s; 2 ^ (unat userSizea + 4) \<le> gsMaxObjectSize s; unat userSizea + 4 < word_bits; is_aligned regionBase (unat userSizea + 4); htd_safe domain (hrs_htd (t_hrs_' (globals s'))); htd_safe domain (ptr_arr_retyps (2 ^ unat userSizea) (cte_Ptr regionBase) (hrs_htd (t_hrs_' (globals s')))); cap_cnode_cap_lift (ret__struct_cap_C_' t) = \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0, capCNodeGuard_CL = 0, capCNodePtr_CL = regionBase\<rparr>; cap_lift (ret__struct_cap_C_' t) = Some (Cap_cnode_cap \<lparr>capCNodeRadix_CL = userSizea && mask 5, capCNodeGuardSize_CL = 0, capCNodeGuard_CL = 0, capCNodePtr_CL = regionBase\<rparr>)\<rbrakk> \<Longrightarrow> True
 2. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 3. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 4. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 5. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (4 subgoals):
 1. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s) and (\<lambda>s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) isdev s)) s
 2. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 3. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 4. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (4 subgoals):
 1. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); createObject_hs_preconds regionBase (APIObjectType apiType) (unat userSizea) (to_bool deviceMemory) s\<rbrakk> \<Longrightarrow> (apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.Untyped) (unat userSizea) (to_bool deviceMemory) s) \<and> (apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) (unat userSizea) (to_bool deviceMemory) s) \<and> (apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) (unat userSizea) (to_bool deviceMemory) s) \<and> (apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) (unat userSizea) (to_bool deviceMemory) s) \<and> (apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) (unat userSizea) (to_bool deviceMemory) s)
 2. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 3. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 4. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (4 subgoals):
 1. \<And>deviceMemory userSizea apiType s n na nb nc nd ne nf ng nh ni nj nk. \<lbrakk>isdev = to_bool deviceMemory; na < 2 ^ LENGTH(32); userSize = na; newType = APIObjectType apiType; nb < 2 ^ LENGTH(32); 0 < nb; nc < 2 ^ LENGTH(32); {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) nc} \<inter> kernel_data_refs = {}; nd < 2 ^ LENGTH(32); range_cover regionBase (APIType_capBits (APIObjectType apiType) nd) (APIType_capBits (APIObjectType apiType) nd) (Suc 0); ne < 2 ^ LENGTH(32); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> ne \<le> maxUntypedSizeBits; nf < 2 ^ LENGTH(32); apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> nf < 28; ng < 2 ^ LENGTH(32); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> ng; nh < 2 ^ LENGTH(32); apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < nh; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); ni < 2 ^ LENGTH(32); createObject_hs_preconds regionBase (APIObjectType apiType) ni (to_bool deviceMemory) s; n < 2 ^ LENGTH(32); nj < 2 ^ LENGTH(32); \<not> nj \<le> n; nk < 2 ^ LENGTH(32); unat userSizea = na; unat regionBase = nb; unat userSizea = nc; unat userSizea = nd; unat userSizea = ne; unat userSizea = nf; unat userSizea = ng; unat userSizea = nh; unat userSizea = ni; unat (object_type_from_H (APIObjectType apiType)) = n; unat (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount) = nj; unat userSizea = nk\<rbrakk> \<Longrightarrow> (apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.Untyped) nk (to_bool deviceMemory) s) \<and> (apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.TCBObject) nk (to_bool deviceMemory) s) \<and> (apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.EndpointObject) nk (to_bool deviceMemory) s) \<and> (apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.NotificationObject) nk (to_bool deviceMemory) s) \<and> (apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> createObject_hs_preconds regionBase (APIObjectType ArchTypes_H.apiobject_type.CapTableObject) nk (to_bool deviceMemory) s)
 2. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 3. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 4. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (3 subgoals):
 1. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); s \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0)}\<rbrakk> \<Longrightarrow> s \<in> {s. apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> s \<in> UNIV} \<inter> {s. apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}} \<inter> {s. apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ getObjectSize (APIObjectType apiType) (unat userSizea)) 0)}}
 2. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 3. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (3 subgoals):
 1. \<And>deviceMemory userSizea apiType s. \<lbrakk>\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> object_type_from_H (APIObjectType apiType); isdev = to_bool deviceMemory; userSize = unat userSizea; newType = APIObjectType apiType; regionBase \<noteq> 0; {regionBase..+2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)} \<inter> kernel_data_refs = {}; range_cover regionBase (APIType_capBits (APIObjectType apiType) (unat userSizea)) (APIType_capBits (APIObjectType apiType) (unat userSizea)) (Suc 0); apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSizea \<le> maxUntypedSizeBits; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSizea < 28; apiType = ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSizea; apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSizea; to_bool deviceMemory \<longrightarrow> apiType = ArchTypes_H.apiobject_type.Untyped \<or> isFrameType (APIObjectType apiType); region_actually_is_bytes regionBase (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) s; \<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) regionBase = replicate (2 ^ APIType_capBits (APIObjectType apiType) (unat userSizea)) 0\<rbrakk> \<Longrightarrow> (apiType = ArchTypes_H.apiobject_type.TCBObject \<longrightarrow> region_actually_is_bytes regionBase (2 ^ objBits makeObject) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0)) \<and> (apiType = ArchTypes_H.apiobject_type.EndpointObject \<longrightarrow> region_actually_is_bytes regionBase (2 ^ objBits makeObject) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0)) \<and> (apiType = ArchTypes_H.apiobject_type.NotificationObject \<longrightarrow> region_actually_is_bytes regionBase (2 ^ objBits makeObject) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ objBits makeObject) regionBase = replicate (2 ^ objBits makeObject) 0)) \<and> (apiType = ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> region_actually_is_bytes regionBase (2 ^ (objBits makeObject + unat userSizea)) s \<and> (\<not> to_bool deviceMemory \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ (objBits makeObject + unat userSizea)) regionBase = replicate (2 ^ (objBits makeObject + unat userSizea)) 0))
 2. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 3. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (2 subgoals):
 1. \<And>deviceMemory userSizea regionBasea t. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; \<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t\<rbrakk> \<Longrightarrow> \<exists>apiType. newType = APIObjectType apiType
 2. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal (1 subgoal):
 1. \<And>deviceMemory userSizea regionBasea t s s'. \<lbrakk>regionBase \<noteq> 0 \<and> {regionBase..+2 ^ APIType_capBits newType userSize} \<inter> kernel_data_refs = {} \<and> range_cover regionBase (APIType_capBits newType userSize) (APIType_capBits newType userSize) (Suc 0) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType); to_bool deviceMemory = isdev; unat userSizea = userSize; PTR(unit) regionBase = regionBasea; object_type_from_H newType = t; (s, s') \<in> rf_sr; (invs' and pspace_no_overlap' regionBase (APIType_capBits newType userSize) and caps_overlap_reserved' {regionBase..+2 ^ APIType_capBits newType userSize} and (\<lambda>s. 2 ^ APIType_capBits newType userSize \<le> gsMaxObjectSize s)) s; s' \<in> {s. region_actually_is_bytes regionBase (2 ^ APIType_capBits newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ APIType_capBits newType userSize) regionBase = replicate (2 ^ APIType_capBits newType userSize) 0)}\<rbrakk> \<Longrightarrow> ((SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> createObject_hs_preconds regionBase newType userSize isdev s)) \<and> s' \<in> {s. (SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)}) \<and> (\<not> SCAST(32 signed \<rightarrow> 32) seL4_NonArchObjectTypeCount \<le> t \<longrightarrow> s \<in> {s. region_actually_is_bytes regionBase (2 ^ getObjectSize newType userSize) s \<and> (\<not> isdev \<longrightarrow> heap_list (hrs_mem (t_hrs_' (globals s))) (2 ^ getObjectSize newType userSize) regionBase = replicate (2 ^ getObjectSize newType userSize) 0)})} proof (prove)
goal:
No subgoals! proof (state)
this:
ccorres ccap_relation ret__struct_cap_C_' (createObject_hs_preconds regionBase newType userSize isdev) (createObject_c_preconds regionBase newType userSize isdev) [] (global.createObject newType regionBase userSize isdev) (Call createObject_'proc)

goal:
No subgoals!