theory Invoke_C

lemma invokeUntyped_Retype_ccorres:
  "ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
     (invs' and ct_active' and ex_cte_cap_to' cnodeptr
       and (\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False
          | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n)
       and valid_untyped_inv' (Retype cref reset ptr_base ptr newType us destSlots isdev)
       and K (isdev \<longrightarrow> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped
                \<or> isFrameType newType)))
     (UNIV \<inter>  {s. retypeBase_' s = Ptr ptr}
           \<inter>  {s. srcSlot_' s = Ptr cref}
           \<inter>  {s. reset_' s = from_bool reset}
           \<inter>  {s. newType_' s = object_type_from_H newType }
           \<inter>  {s. unat (userSize_' s) = us }
           \<inter>  {s. deviceMemory_' s = from_bool isdev}
           \<inter>  {s. destCNode_' s = cte_Ptr cnodeptr}
           \<inter>  {s. destOffset_' s = start \<and> (\<forall>n < length destSlots. destSlots ! n = cnodeptr + (start + of_nat n) * 2^cteSizeBits)}
           \<inter>  {s. destLength_' s = of_nat (length destSlots)})
     []
     (invokeUntyped (Retype cref reset ptr_base ptr newType us destSlots isdev))
     (Call invokeUntyped_Retype_'proc)"
  (is "ccorres _ _ _ ?P' [] _ _") apply (rule ccorres_name_pre) apply (clarsimp simp only: valid_untyped_inv_wcap') proof - fix s sz idx cte assume vui1: "valid_untyped_inv_wcap'
         (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)
         (Some (case Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots
                      isdev of
                Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow>
                  capability.UntypedCap d (ptr && ~~ mask sz) sz idx))
         s"
      and misc1[simplified]: "ct_active' s" "invs' s" "ex_cte_cap_to' cnodeptr s"
      "case gsCNodes s cnodeptr of None \<Rightarrow> False
        | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n"
     "K (isdev \<longrightarrow> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType)) s" have vui: "valid_untyped_inv_wcap' (Retype cref reset ptr_base ptr newType us destSlots isdev)
        (Some (UntypedCap isdev (ptr && ~~ mask sz) sz idx)) s" using vui1 by (clarsimp simp: cte_wp_at_ctes_of) have proofs: "invokeUntyped_proofs s cref reset ptr_base ptr newType us destSlots sz idx isdev" using vui misc1 by (clarsimp simp: cte_wp_at_ctes_of invokeUntyped_proofs_def) note no_simps[simp del] = untyped_range.simps usable_untyped_range.simps
         atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff
         Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex
         usableUntypedRange.simps have cover:
      "range_cover ptr sz (APIType_capBits newType us) (length destSlots)" using vui by (clarsimp simp: cte_wp_at_ctes_of) have us_misc:
      "newType = APIObjectType apiobject_type.CapTableObject \<longrightarrow> 0 < us"
      "newType = APIObjectType apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits" using vui by (auto simp: cte_wp_at_ctes_of) note bits_low = APIType_capBits_low[OF us_misc] have misc2:
      "destSlots \<noteq> []" "ptr_base && ~~ mask sz = ptr_base" using vui by (clarsimp simp: cte_wp_at_ctes_of)+ note misc = misc1 misc2 have us_misc':
      "(newType = APIObjectType apiobject_type.CapTableObject \<longrightarrow> us < 28)" using cover apply - apply (drule range_cover_sz') apply (clarsimp simp: APIType_capBits_def objBits_simps' word_bits_conv) done have ptr_base_eq:
      "ptr_base = ptr && ~~ mask sz" using vui by (clarsimp simp: cte_wp_at_ctes_of)+ have sz_bound [simplified maxUntypedSizeBits_def, simplified]:
      "sz \<le> maxUntypedSizeBits" using vui misc apply (clarsimp simp: cte_wp_at_ctes_of) apply (frule Finalise_R.ctes_of_valid', clarsimp) apply (clarsimp simp: valid_cap_simps') done have some_range_cover_arithmetic:
      "(ptr + (of_nat (length destSlots) << unat (of_nat (APIType_capBits newType us) :: addr))
          - ptr_base >> 4) && mask 26
      = of_nat (getFreeIndex ptr_base
          (ptr + of_nat (shiftL (length destSlots)
              (APIType_capBits newType us)))) >> 4" using cover range_cover_sz'[OF cover] apply (simp add: getFreeIndex_def shiftl_t2n
                       unat_of_nat_eq shiftL_nat) apply (rule less_mask_eq) apply (rule shiftr_less_t2n) apply (rule order_le_less_trans[where y="2 ^ sz"]) apply (rule order_trans[OF _ range_cover_compare_bound_word[OF cover]]) apply (simp add: ptr_base_eq mask_out_sub_mask mult.commute) apply (simp add: word_less_nat_alt order_le_less_trans[OF sz_bound]) apply (rule order_less_le_trans, rule power_strict_increasing,
        rule order_le_less_trans[OF sz_bound lessI], simp+) done show
      "ccorres (cintr \<currency> dc)
         (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s'. s' = s) ?P'
         [] (invokeUntyped (Retype cref reset ptr_base ptr newType us destSlots isdev))
            (Call invokeUntyped_Retype_'proc)" apply (cinit lift: retypeBase_' srcSlot_' reset_' newType_'
                          userSize_' deviceMemory_' destCNode_' destOffset_' destLength_'
                    simp: when_def archOverlap_def) apply (rule ccorres_move_c_guard_cte) apply csymbr apply (rule ccorres_abstract_cleanup) apply (rename_tac ptr_fetch,
         rule_tac P="ptr_fetch = ptr_base" in ccorres_gen_asm2) apply csymbr apply csymbr apply (simp add: from_bool_0 del: Collect_const) apply (rule_tac xf'=xfdc and r'=dc in ccorres_splitE) apply (rule ccorres_Cond_rhs) apply (simp add: whenE_def) apply (rule ccorres_add_returnOk) apply (ctac add: resetUntypedCap_ccorres) apply (simp add: ccorres_cond_empty_iff) apply (rule ccorres_returnOk_skip) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def cintr_def) apply wp apply (vcg exspec=resetUntypedCap_modifies) apply (simp add: whenE_def) apply (rule ccorres_returnOk_skip) apply ceqv apply (simp add: liftE_def bind_assoc) apply csymbr apply (rule ccorres_Guard_Seq) apply csymbr apply csymbr apply (rule ccorres_move_c_guard_cte) apply (rule ccorres_stateAssert) apply (rule ccorres_cross_retype_zero_bytes_over_guard[where
             dev=isdev and p=cref, OF cover]) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_split_nothrow[where r'=dc and xf'=xfdc]) apply (rule_tac cap'="UntypedCap isdev ptr_base sz (if reset then 0 else idx)"
                  in updateFreeIndex_ccorres) apply (rule allI, rule conseqPre, vcg) apply (rule subsetI, clarsimp simp: typ_heap_simps' isCap_simps) apply (frule ccte_relation_ccap_relation) apply clarsimp apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (cut_tac some_range_cover_arithmetic) apply (case_tac cte', clarsimp simp: modify_map_def fun_eq_iff split: if_split) apply (simp add: mex_def meq_def ptr_base_eq) apply (rule exI, strengthen refl, simp) apply (strengthen globals.fold_congs, simp add: field_simps) apply ceqv apply (ctac add: createNewObjects_ccorres[where sz = sz and
                            start = start and cnodeptr=cnodeptr and
                            num = "of_nat (length destSlots)"
                            and idx = "getFreeIndex ptr_base
                                 (ptr + of_nat (shiftL (length destSlots) (APIType_capBits newType us)))"]) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply wp apply (vcg exspec=createNewObjects_modifies) apply simp apply (wp updateFreeIndex_forward_invs' sch_act_simple_lift
                    updateFreeIndex_cte_wp_at hoare_vcg_const_Ball_lift
                    updateFreeIndex_pspace_no_overlap'
                    updateFreeIndex_caps_no_overlap''
                    updateFreeIndex_caps_overlap_reserved
                    updateFreeIndex_descendants_range_in'
                  | simp)+ apply (clarsimp simp: misc unat_of_nat_eq[OF range_cover.weak, OF cover]) apply (vcg exspec=cap_untyped_cap_ptr_set_capFreeIndex_modifies) apply simp apply (rule validE_validE_R, rule hoare_post_impErr,
          rule hoare_vcg_conj_liftE1[rotated, where Q="\<lambda>_ s.
            case gsCNodes s cnodeptr of None \<Rightarrow> False
              | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n"],
          rule whenE_reset_resetUntypedCap_invs_etc
              [where ui="Retype cref reset ptr_base ptr newType us destSlots isdev"
                 and dev=isdev and ptr="ptr && ~~ mask sz" and ptr'=ptr and sz=sz and idx=idx]) apply (simp add: whenE_def, wp resetUntypedCap_gsCNodes_at_pt)[1] prefer 2 apply simp apply (clarsimp simp only: ) apply (frule(2) invokeUntyped_proofs.intro) apply (cut_tac bits_low us_misc us_misc') apply (clarsimp simp: cte_wp_at_ctes_of
                              invokeUntyped_proofs.caps_no_overlap'
                              invokeUntyped_proofs.ps_no_overlap'
                              invokeUntyped_proofs.descendants_range
                              if_split[where P="\<lambda>v. v \<le> getFreeIndex x y" for x y]
                              empty_descendants_range_in'
                              invs_pspace_aligned' invs_pspace_distinct'
                              invs_ksCurDomain_maxDomain'
                              invokeUntyped_proofs.not_0_ptr
                              atLeastAtMost_iff[where i=0]
                        cong: if_cong) apply (frule invokeUntyped_proofs.idx_le_new_offs) apply (frule invokeUntyped_proofs.szw) apply (frule invokeUntyped_proofs.descendants_range(2), simp) apply (simp add: cNodeNoOverlap_retype_have_size shiftL_nat mult.commute) apply (clarsimp simp: getFreeIndex_def conj_comms shiftL_nat
                              is_aligned_weaken[OF range_cover.funky_aligned]
                              invs_valid_pspace' isCap_simps
                              arg_cong[OF mask_out_sub_mask, where f="\<lambda>y. x - y" for x]
                              field_simps unat_of_nat_eq[OF range_cover.weak, OF cover]
                              if_apply_def2 invs_valid_objs' ptr_base_eq
                              invs_urz untypedBits_defs) apply (intro conjI) 
                 (* pspace_no_overlap *)
                  apply (cases reset, simp_all)[1] 
                (* is_aligned 4 *)
                 apply (erule is_aligned_weaken[OF range_cover.aligned]) apply (clarsimp simp: APIType_capBits_low) 
               (* new idx le *)
                apply (clarsimp split: if_split) 
              (* cnodeptr not in area *)
               apply (rule contra_subsetD[rotated],
                rule invokeUntyped_proofs.ex_cte_no_overlap'[OF proofs], rule misc) apply (simp add: shiftl_t2n mult.commute) apply (rule order_trans, erule range_cover_subset', simp_all)[1] 
             (* gsCNodes *)
              apply (clarsimp split: option.split_asm) 
            (* kernel data refs *)
             apply (drule(1) valid_global_refsD'[OF _ invs_valid_global']) apply clarsimp apply (subst Int_commute, erule disjoint_subset2[rotated]) apply (rule order_trans, erule invokeUntyped_proofs.subset_stuff) apply (simp add: atLeastatMost_subset_iff word_and_le2) 
           (* offset bounds *)
            apply (frule range_cover.unat_of_nat_n_shift, rule order_refl) apply (rule order_trans[rotated], erule range_cover.range_cover_compare_bound) apply (subst unat_plus_simple[THEN iffD1]) apply (rule order_trans, erule range_cover.range_cover_base_le,
              simp add: shiftl_t2n field_simps) apply (simp add: shiftl_t2n field_simps) 
          (* subsets *)
           apply (rule order_trans, erule invokeUntyped_proofs.subset_stuff) apply (simp add: atLeastatMost_subset_iff word_and_le2) 
         (* destSlots *)
          apply (clarsimp split: if_split) apply (frule invokeUntyped_proofs.slots_invD[OF proofs]) apply (simp add: conj_comms) 
        (* usableUntyped *)
         apply (drule invokeUntyped_proofs.usableRange_disjoint[where d=isdev]) apply (clarsimp simp: field_simps mask_out_sub_mask) 

       (* clean up the C postcondition before applying VCG *)
        apply (rule conseqPost[where Q'=UNIV and Q'=UNIV]) apply (vcg exspec=resetUntypedCap_modifies) apply (cut_tac range_cover.sz[OF cover]
                       invokeUntyped_proofs.idx_le_new_offs[OF proofs]) apply (clarsimp simp: ccHoarePost_def hrs_mem_update
                              object_type_from_H_bound
                              typ_heap_simps' word_sle_def
                              word_of_nat_less zero_bytes_heap_update
                              region_actually_is_bytes) apply (frule ccte_relation_ccap_relation) apply (cut_tac vui) apply (clarsimp simp: cap_get_tag_isCap getFreeIndex_def
                              cte_wp_at_ctes_of shiftL_nat
                       split: if_split) apply (simp add: mask_out_sub_mask field_simps region_is_bytes'_def objBits_defs) apply (clarsimp elim!: region_actually_is_bytes_subset) apply (rule order_refl) apply (cut_tac misc us_misc' proofs us_misc bits_low
                     invokeUntyped_proofs.cref_inv[OF proofs]) apply (clarsimp simp: cte_wp_at_ctes_of invokeUntyped_proofs_def
                            descendants_range'_def2 sch_act_simple_def
                            invs_valid_pspace' range_cover.sz) apply (frule ctes_of_valid', fastforce) apply (clarsimp simp: valid_cap'_def capAligned_def ct_in_state'_def
                            invs_valid_objs' inr_rrel_def) apply (erule(1) rf_sr_ctes_of_cliftE) apply (frule(2) rf_sr_cte_relation) apply (clarsimp simp: cap_get_tag_isCap typ_heap_simps
                     dest!: ccte_relation_ccap_relation) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (intro conjI) apply clarsimp apply (drule invokeUntyped_proofs.ex_cte_no_overlap'[OF proofs]) apply simp apply (frule(1) cap_get_tag_to_H) apply (simp add: cap_lift_untyped_cap) apply clarsimp done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and ct_active' and ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr and (\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n) and valid_untyped_inv' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) and K (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType)) (UNIV \<inter> \<lbrace>\<acute>retypeBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>reset = from_bool reset\<rbrace> \<inter> \<lbrace>\<acute>newType = object_type_from_H newType\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>\<acute>deviceMemory = from_bool isdev\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots)\<rbrace>) [] (invokeUntyped (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)) (Call invokeUntyped_Retype_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>s. (invs' and ct_active' and ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr and (\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n) and valid_untyped_inv' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) and K (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType)) s \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s'. s' = s) (UNIV \<inter> \<lbrace>\<acute>retypeBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>reset = from_bool reset\<rbrace> \<inter> \<lbrace>\<acute>newType = object_type_from_H newType\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>\<acute>deviceMemory = from_bool isdev\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots)\<rbrace>) [] (invokeUntyped (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)) (Call invokeUntyped_Retype_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>K (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; invs' s; ct_active' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (case Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s'. s' = s) (UNIV \<inter> \<lbrace>\<acute>retypeBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>reset = from_bool reset\<rbrace> \<inter> \<lbrace>\<acute>newType = object_type_from_H newType\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>\<acute>deviceMemory = from_bool isdev\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots)\<rbrace>) [] (invokeUntyped (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)) (Call invokeUntyped_Retype_'proc) proof (state)
goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>K (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; invs' s; ct_active' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (case Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s'. s' = s) (UNIV \<inter> \<lbrace>\<acute>retypeBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>reset = from_bool reset\<rbrace> \<inter> \<lbrace>\<acute>newType = object_type_from_H newType\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>\<acute>deviceMemory = from_bool isdev\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots)\<rbrace>) [] (invokeUntyped (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)) (Call invokeUntyped_Retype_'proc) proof (state)
goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>K (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; invs' s; ct_active' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (case Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s'. s' = s) (UNIV \<inter> \<lbrace>\<acute>retypeBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>reset = from_bool reset\<rbrace> \<inter> \<lbrace>\<acute>newType = object_type_from_H newType\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>\<acute>deviceMemory = from_bool isdev\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots)\<rbrace>) [] (invokeUntyped (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)) (Call invokeUntyped_Retype_'proc) proof (state)
this:
valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (case Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s
ct_active' s
invs' s
ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s
case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n
isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>K (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; invs' s; ct_active' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (case Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s'. s' = s) (UNIV \<inter> \<lbrace>\<acute>retypeBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>reset = from_bool reset\<rbrace> \<inter> \<lbrace>\<acute>newType = object_type_from_H newType\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>\<acute>deviceMemory = from_bool isdev\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots)\<rbrace>) [] (invokeUntyped (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)) (Call invokeUntyped_Retype_'proc) proof (prove)
goal (1 subgoal):
 1. valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) s proof (prove)
using this:
valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (case Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s

goal (1 subgoal):
 1. valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) s proof (state)
this:
valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) s

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>K (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; invs' s; ct_active' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (case Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s'. s' = s) (UNIV \<inter> \<lbrace>\<acute>retypeBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>reset = from_bool reset\<rbrace> \<inter> \<lbrace>\<acute>newType = object_type_from_H newType\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>\<acute>deviceMemory = from_bool isdev\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots)\<rbrace>) [] (invokeUntyped (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)) (Call invokeUntyped_Retype_'proc) proof (prove)
goal (1 subgoal):
 1. invokeUntyped_proofs s cref reset ptr_base ptr newType us destSlots sz idx isdev proof (prove)
using this:
valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) s
ct_active' s
invs' s
ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s
case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n
isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType

goal (1 subgoal):
 1. invokeUntyped_proofs s cref reset ptr_base ptr newType us destSlots sz idx isdev proof (state)
this:
invokeUntyped_proofs s cref reset ptr_base ptr newType us destSlots sz idx isdev

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>K (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; invs' s; ct_active' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (case Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s'. s' = s) (UNIV \<inter> \<lbrace>\<acute>retypeBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>reset = from_bool reset\<rbrace> \<inter> \<lbrace>\<acute>newType = object_type_from_H newType\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>\<acute>deviceMemory = from_bool isdev\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots)\<rbrace>) [] (invokeUntyped (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)) (Call invokeUntyped_Retype_'proc) proof (state)
this:
untyped_range (cap.UntypedCap ?dev ?p ?n ?f) = {?p..?p + (1 << ?n) - 1}
untyped_range cap.NullCap = {}
untyped_range (cap.EndpointCap ?r ?badge ?rights) = {}
untyped_range (cap.NotificationCap ?r ?badge ?rights) = {}
untyped_range (cap.CNodeCap ?r ?bits ?guard) = {}
untyped_range (cap.ThreadCap ?r) = {}
untyped_range cap.DomainCap = {}
untyped_range (cap.ReplyCap ?r ?master ?rights) = {}
untyped_range cap.IRQControlCap = {}
untyped_range (cap.IRQHandlerCap ?irq) = {}
untyped_range (cap.Zombie ?r ?b ?n) = {}
untyped_range (cap.ArchObjectCap ?cap) = {}
usable_untyped_range (cap.UntypedCap ?uu ?p ?n ?f) = (if ?f < 2 ^ ?n then {?p + word_of_nat ?f..?p + 2 ^ ?n - 1} else {})
(?i \<in> {?l..?u}) = (?l \<le> ?i \<and> ?i \<le> ?u)
({?a..?b} \<subseteq> {?c..?d}) = (\<not> ?a \<le> ?b \<or> ?c \<le> ?a \<and> ?b \<le> ?d)
(?i \<in> {?l..<?u}) = (?l \<le> ?i \<and> ?i < ?u)
{?a..?b} \<inter> {?c..?d} = {max ?a ?c..min ?b ?d}
({?a..?b} = {}) = (\<not> ?a \<le> ?b)
(\<exists>x. ?P x) = (\<exists>a b. ?P (a, b))
usableUntypedRange (capability.UntypedCap ?d ?p ?n ?f) = (if ?f < 2 ^ ?n then {?p + word_of_nat ?f..?p + 2 ^ ?n - 1} else {})

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>K (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; invs' s; ct_active' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (case Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s'. s' = s) (UNIV \<inter> \<lbrace>\<acute>retypeBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>reset = from_bool reset\<rbrace> \<inter> \<lbrace>\<acute>newType = object_type_from_H newType\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>\<acute>deviceMemory = from_bool isdev\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots)\<rbrace>) [] (invokeUntyped (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)) (Call invokeUntyped_Retype_'proc) proof (prove)
goal (1 subgoal):
 1. range_cover ptr sz (APIType_capBits newType us) (length destSlots) proof (prove)
using this:
valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) s

goal (1 subgoal):
 1. range_cover ptr sz (APIType_capBits newType us) (length destSlots) proof (state)
this:
range_cover ptr sz (APIType_capBits newType us) (length destSlots)

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>K (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; invs' s; ct_active' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (case Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s'. s' = s) (UNIV \<inter> \<lbrace>\<acute>retypeBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>reset = from_bool reset\<rbrace> \<inter> \<lbrace>\<acute>newType = object_type_from_H newType\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>\<acute>deviceMemory = from_bool isdev\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots)\<rbrace>) [] (invokeUntyped (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)) (Call invokeUntyped_Retype_'proc) proof (prove)
goal (1 subgoal):
 1. newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us &&& newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits proof (prove)
using this:
valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) s

goal (1 subgoal):
 1. newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us &&& newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits proof (state)
this:
newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us
newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>K (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; invs' s; ct_active' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (case Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s'. s' = s) (UNIV \<inter> \<lbrace>\<acute>retypeBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>reset = from_bool reset\<rbrace> \<inter> \<lbrace>\<acute>newType = object_type_from_H newType\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>\<acute>deviceMemory = from_bool isdev\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots)\<rbrace>) [] (invokeUntyped (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)) (Call invokeUntyped_Retype_'proc) proof (state)
this:
4 \<le> APIType_capBits newType us

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>K (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; invs' s; ct_active' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (case Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s'. s' = s) (UNIV \<inter> \<lbrace>\<acute>retypeBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>reset = from_bool reset\<rbrace> \<inter> \<lbrace>\<acute>newType = object_type_from_H newType\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>\<acute>deviceMemory = from_bool isdev\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots)\<rbrace>) [] (invokeUntyped (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)) (Call invokeUntyped_Retype_'proc) proof (prove)
goal (1 subgoal):
 1. destSlots \<noteq> [] &&& ptr_base && ~~ mask sz = ptr_base proof (prove)
using this:
valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) s

goal (1 subgoal):
 1. destSlots \<noteq> [] &&& ptr_base && ~~ mask sz = ptr_base proof (state)
this:
destSlots \<noteq> []
ptr_base && ~~ mask sz = ptr_base

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>K (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; invs' s; ct_active' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (case Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s'. s' = s) (UNIV \<inter> \<lbrace>\<acute>retypeBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>reset = from_bool reset\<rbrace> \<inter> \<lbrace>\<acute>newType = object_type_from_H newType\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>\<acute>deviceMemory = from_bool isdev\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots)\<rbrace>) [] (invokeUntyped (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)) (Call invokeUntyped_Retype_'proc) proof (state)
this:
ct_active' s
invs' s
ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s
case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n
isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType
destSlots \<noteq> []
ptr_base && ~~ mask sz = ptr_base

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>K (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; invs' s; ct_active' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (case Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s'. s' = s) (UNIV \<inter> \<lbrace>\<acute>retypeBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>reset = from_bool reset\<rbrace> \<inter> \<lbrace>\<acute>newType = object_type_from_H newType\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>\<acute>deviceMemory = from_bool isdev\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots)\<rbrace>) [] (invokeUntyped (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)) (Call invokeUntyped_Retype_'proc) proof (prove)
goal (1 subgoal):
 1. newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28 proof (prove)
using this:
range_cover ptr sz (APIType_capBits newType us) (length destSlots)

goal (1 subgoal):
 1. newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28 proof (prove)
goal (1 subgoal):
 1. range_cover ptr sz (APIType_capBits newType us) (length destSlots) \<Longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28 proof (prove)
goal (1 subgoal):
 1. APIType_capBits newType us < LENGTH(32) \<Longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28 proof (prove)
goal:
No subgoals! proof (state)
this:
newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>K (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; invs' s; ct_active' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (case Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s'. s' = s) (UNIV \<inter> \<lbrace>\<acute>retypeBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>reset = from_bool reset\<rbrace> \<inter> \<lbrace>\<acute>newType = object_type_from_H newType\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>\<acute>deviceMemory = from_bool isdev\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots)\<rbrace>) [] (invokeUntyped (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)) (Call invokeUntyped_Retype_'proc) proof (prove)
goal (1 subgoal):
 1. ptr_base = ptr && ~~ mask sz proof (prove)
using this:
valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) s

goal (1 subgoal):
 1. ptr_base = ptr && ~~ mask sz proof (state)
this:
ptr_base = ptr && ~~ mask sz

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>K (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; invs' s; ct_active' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (case Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s'. s' = s) (UNIV \<inter> \<lbrace>\<acute>retypeBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>reset = from_bool reset\<rbrace> \<inter> \<lbrace>\<acute>newType = object_type_from_H newType\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>\<acute>deviceMemory = from_bool isdev\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots)\<rbrace>) [] (invokeUntyped (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)) (Call invokeUntyped_Retype_'proc) proof (prove)
goal (1 subgoal):
 1. sz \<le> maxUntypedSizeBits proof (prove)
using this:
valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) s
ct_active' s
invs' s
ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s
case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n
isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType
destSlots \<noteq> []
ptr_base && ~~ mask sz = ptr_base

goal (1 subgoal):
 1. sz \<le> maxUntypedSizeBits proof (prove)
goal (1 subgoal):
 1. \<And>cte. \<lbrakk>ct_active' s; invs' s; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; destSlots \<noteq> []; range_cover ptr sz (APIType_capBits newType us) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx; ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; APIType_capBits newType us \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> sz \<le> maxUntypedSizeBits proof (prove)
goal (1 subgoal):
 1. \<And>cte. \<lbrakk>ct_active' s; invs' s; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; destSlots \<noteq> []; range_cover ptr sz (APIType_capBits newType us) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx; ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; APIType_capBits newType us \<le> maxUntypedSizeBits; valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> sz \<le> maxUntypedSizeBits proof (prove)
goal:
No subgoals! proof (state)
this:
sz \<le> 29

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>K (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; invs' s; ct_active' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (case Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s'. s' = s) (UNIV \<inter> \<lbrace>\<acute>retypeBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>reset = from_bool reset\<rbrace> \<inter> \<lbrace>\<acute>newType = object_type_from_H newType\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>\<acute>deviceMemory = from_bool isdev\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots)\<rbrace>) [] (invokeUntyped (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)) (Call invokeUntyped_Retype_'proc) proof (prove)
goal (1 subgoal):
 1. (ptr + (word_of_nat (length destSlots) << unat (word_of_nat (APIType_capBits newType us))) - ptr_base >> 4) && mask 26 = word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) >> 4 proof (prove)
using this:
range_cover ptr sz (APIType_capBits newType us) (length destSlots)
APIType_capBits newType us < LENGTH(32)

goal (1 subgoal):
 1. (ptr + (word_of_nat (length destSlots) << unat (word_of_nat (APIType_capBits newType us))) - ptr_base >> 4) && mask 26 = word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) >> 4 proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (APIType_capBits newType us) (length destSlots); APIType_capBits newType us < 32\<rbrakk> \<Longrightarrow> (ptr + 2 ^ APIType_capBits newType us * word_of_nat (length destSlots) - ptr_base >> 4) && mask 26 = ptr + 2 ^ APIType_capBits newType us * word_of_nat (length destSlots) - ptr_base >> 4 proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (APIType_capBits newType us) (length destSlots); APIType_capBits newType us < 32\<rbrakk> \<Longrightarrow> ptr + 2 ^ APIType_capBits newType us * word_of_nat (length destSlots) - ptr_base >> 4 < 2 ^ 26 proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (APIType_capBits newType us) (length destSlots); APIType_capBits newType us < 32\<rbrakk> \<Longrightarrow> ptr + 2 ^ APIType_capBits newType us * word_of_nat (length destSlots) - ptr_base < 2 ^ (4 + 26) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (APIType_capBits newType us) (length destSlots); APIType_capBits newType us < 32\<rbrakk> \<Longrightarrow> ptr + 2 ^ APIType_capBits newType us * word_of_nat (length destSlots) - ptr_base \<le> 2 ^ sz
 2. \<lbrakk>range_cover ptr sz (APIType_capBits newType us) (length destSlots); APIType_capBits newType us < 32\<rbrakk> \<Longrightarrow> 2 ^ sz < 2 ^ (4 + 26) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>range_cover ptr sz (APIType_capBits newType us) (length destSlots); APIType_capBits newType us < 32\<rbrakk> \<Longrightarrow> ptr + 2 ^ APIType_capBits newType us * word_of_nat (length destSlots) - ptr_base \<le> word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us + (ptr && mask sz)
 2. \<lbrakk>range_cover ptr sz (APIType_capBits newType us) (length destSlots); APIType_capBits newType us < 32\<rbrakk> \<Longrightarrow> 2 ^ sz < 2 ^ (4 + 26) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (APIType_capBits newType us) (length destSlots); APIType_capBits newType us < 32\<rbrakk> \<Longrightarrow> 2 ^ sz < 2 ^ (4 + 26) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>range_cover ptr sz (APIType_capBits newType us) (length destSlots); APIType_capBits newType us < 32\<rbrakk> \<Longrightarrow> 2 ^ sz < 1073741824 proof (prove)
goal:
No subgoals! proof (state)
this:
(ptr + (word_of_nat (length destSlots) << unat (word_of_nat (APIType_capBits newType us))) - ptr_base >> 4) && mask 26 = word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) >> 4

goal (1 subgoal):
 1. \<And>s sz idx. \<lbrakk>K (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; invs' s; ct_active' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (case Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev of Invocations_H.untyped_invocation.Retype slot reset ptr_base ptr ty us slots d \<Rightarrow> capability.UntypedCap d (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s'. s' = s) (UNIV \<inter> \<lbrace>\<acute>retypeBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>reset = from_bool reset\<rbrace> \<inter> \<lbrace>\<acute>newType = object_type_from_H newType\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>\<acute>deviceMemory = from_bool isdev\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots)\<rbrace>) [] (invokeUntyped (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)) (Call invokeUntyped_Retype_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s'. s' = s) (UNIV \<inter> \<lbrace>\<acute>retypeBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>reset = from_bool reset\<rbrace> \<inter> \<lbrace>\<acute>newType = object_type_from_H newType\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>\<acute>deviceMemory = from_bool isdev\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots)\<rbrace>) [] (invokeUntyped (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)) (Call invokeUntyped_Retype_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3473 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase) (?Q'3473 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase) [SKIP] (doE y <- whenE reset (resetUntypedCap cref);
liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)
odE) (Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))));;
(\<acute>regionBase :== PTR(unit) \<acute>ret__unsigned;;
(lvar_nondet_init status_' status_'_update;;
(IF reseta \<noteq> 0 THEN
  \<acute>status :== CALL resetUntypedCap_'proc(srcSlot);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI;;
(\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(newTypea,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== destLength << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr_val retypeBase + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])),UCAST(32 \<rightarrow> 32) (\<acute>freeRef - ptr_val \<acute>regionBase >> unat 4)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(newTypea,srcSlot,destCNode,destOffset,destLength,retypeBase,userSize,deviceMemory);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 2. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q3473 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa \<and> s' \<in> ?Q'3473 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase proof (prove)
goal (2 subgoals):
 1. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A3479 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase) (?C'3479 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase) [SKIP] (doE y <- whenE reset (resetUntypedCap cref);
liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)
odE) (\<acute>ret__unsigned :== CALL cap_untyped_cap_get_capPtr_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])));;
(\<acute>regionBase :== PTR(unit) \<acute>ret__unsigned;;
(lvar_nondet_init status_' status_'_update;;
(IF reseta \<noteq> 0 THEN
  \<acute>status :== CALL resetUntypedCap_'proc(srcSlot);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI;;
(\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(newTypea,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== destLength << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr_val retypeBase + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])),UCAST(32 \<rightarrow> 32) (\<acute>freeRef - ptr_val \<acute>regionBase >> unat 4)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(newTypea,srcSlot,destCNode,destOffset,destLength,retypeBase,userSize,deviceMemory);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 2. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?A3479 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> ?C'3479 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ret__unsigned. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A3479 destLength start destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase) (?G'3484 destLength start destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ret__unsigned \<inter> \<lbrace>ret__unsigned = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace>) [SKIP] (doE y <- whenE reset (resetUntypedCap cref);
liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)
odE) (\<acute>regionBase :== PTR(unit) ret__unsigned;;
(lvar_nondet_init status_' status_'_update;;
(IF reseta \<noteq> 0 THEN
  \<acute>status :== CALL resetUntypedCap_'proc(srcSlot);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI;;
(\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(newTypea,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== destLength << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr_val retypeBase + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])),UCAST(32 \<rightarrow> 32) (\<acute>freeRef - ptr_val \<acute>regionBase >> unat 4)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(newTypea,srcSlot,destCNode,start,destLength,retypeBase,userSize,deviceMemory);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?A3479 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> ?G'3484 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ret__unsigned. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A3479 destLength start destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase) (?G'3778 destLength start destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ret__unsigned) [SKIP] (doE y <- whenE reset (resetUntypedCap cref);
liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)
odE) (\<acute>regionBase :== PTR(unit) ret__unsigned;;
(lvar_nondet_init status_' status_'_update;;
(IF reseta \<noteq> 0 THEN
  \<acute>status :== CALL resetUntypedCap_'proc(srcSlot);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI;;
(\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(newTypea,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== destLength << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr_val retypeBase + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])),UCAST(32 \<rightarrow> 32) (\<acute>freeRef - ptr_val \<acute>regionBase >> unat 4)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(newTypea,srcSlot,destCNode,start,destLength,retypeBase,userSize,deviceMemory);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?A3479 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> ?G'3778 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A3479 destLength start destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase) (?G'3781 destLength start destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch) [SKIP] (doE y <- whenE reset (resetUntypedCap cref);
liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)
odE) (\<acute>regionBase :== PTR(unit) ptr_fetch;;
(lvar_nondet_init status_' status_'_update;;
(IF reseta \<noteq> 0 THEN
  \<acute>status :== CALL resetUntypedCap_'proc(srcSlot);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI;;
(\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(newTypea,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== destLength << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr_val retypeBase + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])),UCAST(32 \<rightarrow> 32) (\<acute>freeRef - ptr_val \<acute>regionBase >> unat 4)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(newTypea,srcSlot,destCNode,start,destLength,retypeBase,userSize,deviceMemory);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?A3479 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> ?G'3781 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A3479 destLength start destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase) (?G'3790 destLength start destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch) [SKIP] (doE y <- whenE reset (resetUntypedCap cref);
liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)
odE) (lvar_nondet_init status_' status_'_update;;
(IF reseta \<noteq> 0 THEN
  \<acute>status :== CALL resetUntypedCap_'proc(srcSlot);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI;;
(\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(newTypea,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== destLength << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr_val retypeBase + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])),UCAST(32 \<rightarrow> 32) (\<acute>freeRef - ptr_val (PTR(unit) ptr_fetch) >> unat 4)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(newTypea,srcSlot,destCNode,start,destLength,retypeBase,userSize,deviceMemory);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?A3479 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> ?G'3790 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A3479 destLength start destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase) (?G'4074 destLength start destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch) [SKIP] (doE y <- whenE reset (resetUntypedCap cref);
liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)
odE) (IF reseta \<noteq> 0 THEN
  \<acute>status :== CALL resetUntypedCap_'proc(srcSlot);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI;;
(\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(newTypea,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== destLength << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr_val retypeBase + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])),UCAST(32 \<rightarrow> 32) (\<acute>freeRef - ptr_val (PTR(unit) ptr_fetch) >> unat 4)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c srcSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(newTypea,srcSlot,destCNode,start,destLength,retypeBase,userSize,deviceMemory);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?A3479 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> ?G'4074 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A3479 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)) (?G'4074 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) [SKIP] (doE y <- whenE reset (resetUntypedCap cref);
liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)
odE) (IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI;;
(\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(object_type_from_H newType,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== word_of_nat (length destSlots) << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),\<acute>freeRef - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?A3479 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> ?G'4074 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4095 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)) (?P'4088 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) [SKIP] (whenE reset (resetUntypedCap cref)) (IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI)
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(object_type_from_H newType,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== word_of_nat (length destSlots) << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),\<acute>freeRef - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv) (?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv') [SKIP] (liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, -
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v))),UNIV
 6. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P4095 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> ?P'4088 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4101 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)) (?S4104 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) [SKIP] (whenE reset (resetUntypedCap cref)) (\<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI)
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; \<not> reset\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4100 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)) (?T4102 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) [SKIP] (whenE reset (resetUntypedCap cref)) SKIP
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(object_type_from_H newType,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== word_of_nat (length destSlots) << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),\<acute>freeRef - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv) (?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv') [SKIP] (liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, -
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v))),UNIV
 7. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> ?Q4101 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase a) \<and> (\<not> reset \<longrightarrow> ?R4100 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase a)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> ?S4104 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v) \<and> (\<not> reset \<longrightarrow> s \<in> ?T4102 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v)} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4101 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr cref) (PTR(unit) ptr)) (?S4104 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) [SKIP] (resetUntypedCap cref) (\<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI)
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; \<not> reset\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4100 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)) (?T4102 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) [SKIP] (whenE reset (resetUntypedCap cref)) SKIP
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(object_type_from_H newType,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== word_of_nat (length destSlots) << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),\<acute>freeRef - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv) (?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv') [SKIP] (liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, -
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v))),UNIV
 7. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> ?Q4101 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase a) \<and> (\<not> reset \<longrightarrow> ?R4100 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase a)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> ?S4104 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v) \<and> (\<not> reset \<longrightarrow> s \<in> ?T4102 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v)} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4101 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr cref) (PTR(unit) ptr)) (?S4104 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) [SKIP] (resetUntypedCap cref >>=E returnOk) (\<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI)
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; \<not> reset\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4100 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)) (?T4102 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) [SKIP] (whenE reset (resetUntypedCap cref)) SKIP
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(object_type_from_H newType,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== word_of_nat (length destSlots) << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),\<acute>freeRef - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv) (?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv') [SKIP] (liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, -
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v))),UNIV
 7. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> ?Q4101 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase a) \<and> (\<not> reset \<longrightarrow> ?R4100 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase a)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> ?S4104 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v) \<and> (\<not> reset \<longrightarrow> s \<in> ?T4102 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v)} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv status. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset; dc rv (K () status); id status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4119 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv) (?Q'4119 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv status) [SKIP] (returnOk rv) (IF status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. status)
FI)
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch err rv' status. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4119 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch err) (?Q''4119 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI)
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset\<rbrakk> \<Longrightarrow> \<lbrace>?R4127 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> resetUntypedCap cref \<lbrace>?Q4119 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, \<lbrace>?QE4119 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4120 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> ?Q'4119 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv (status_' s))) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (status_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4119 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch err (status_' s) (errstate s)))}
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; \<not> reset\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4100 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)) (?T4102 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) [SKIP] (whenE reset (resetUntypedCap cref)) SKIP
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(object_type_from_H newType,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== word_of_nat (length destSlots) << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),\<acute>freeRef - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv) (?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv') [SKIP] (liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 8. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, -
 9. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v))),UNIV
 10. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and ?R4127 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase) a) \<and> (\<not> reset \<longrightarrow> ?R4100 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase a)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'4120 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v) \<and> (\<not> reset \<longrightarrow> s \<in> ?T4102 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v)} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch status. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset; status = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4119 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()) (?Q'4119 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (returnOk ()) SKIP
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch err rv' status. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4119 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch err) (?Q''4119 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI)
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset\<rbrakk> \<Longrightarrow> \<lbrace>?R4127 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> resetUntypedCap cref \<lbrace>?Q4119 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, \<lbrace>?QE4119 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4120 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> ?Q'4119 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv (status_' s))) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (status_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4119 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch err (status_' s) (errstate s)))}
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; \<not> reset\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4100 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)) (?T4102 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) [SKIP] (whenE reset (resetUntypedCap cref)) SKIP
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(object_type_from_H newType,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== word_of_nat (length destSlots) << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),\<acute>freeRef - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv) (?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv') [SKIP] (liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 8. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, -
 9. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v))),UNIV
 10. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and ?R4127 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase) a) \<and> (\<not> reset \<longrightarrow> ?R4100 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase a)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'4120 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v) \<and> (\<not> reset \<longrightarrow> s \<in> ?T4102 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v)} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch err rv' status. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4119 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch err) (?Q''4119 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch err rv' status) [SKIP] (throwError err) (IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI)
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset\<rbrakk> \<Longrightarrow> \<lbrace>?R4127 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> resetUntypedCap cref \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE4119 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4120 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s. inr_rrel dc (Inr rv) (xfdc s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (status_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4119 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch err (status_' s) (errstate s)))}
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; \<not> reset\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4100 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)) (?T4102 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) [SKIP] (whenE reset (resetUntypedCap cref)) SKIP
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(object_type_from_H newType,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== word_of_nat (length destSlots) << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),\<acute>freeRef - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv) (?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv') [SKIP] (liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, -
 8. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v))),UNIV
 9. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and ?R4127 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase) a) \<and> (\<not> reset \<longrightarrow> ?R4100 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase a)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'4120 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v) \<and> (\<not> reset \<longrightarrow> s \<in> ?T4102 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v)} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch err rv' status. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} IF rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI {},{s. \<exists>(rv, \<sigma>')\<in>fst (throwError err \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> inl_rrel (cintr \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset\<rbrakk> \<Longrightarrow> \<lbrace>?R4127 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> resetUntypedCap cref \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4120 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s. inr_rrel dc (Inr rv) (xfdc s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (status_' s)) (errstate s) \<longrightarrow> s \<in> UNIV))}
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; \<not> reset\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4100 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)) (?T4102 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) [SKIP] (whenE reset (resetUntypedCap cref)) SKIP
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(object_type_from_H newType,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== word_of_nat (length destSlots) << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),\<acute>freeRef - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv) (?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv') [SKIP] (liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, -
 8. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v))),UNIV
 9. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and ?R4127 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase) a) \<and> (\<not> reset \<longrightarrow> ?R4100 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase a)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'4120 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v) \<and> (\<not> reset \<longrightarrow> s \<in> ?T4102 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v)} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch err rv' status \<sigma>. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset; id rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv') status\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (throwError err \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := rv', global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> inl_rrel (cintr \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := rv', global_exn_var_' := Return\<rparr>)))) \<and> (\<not> rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False)}
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset\<rbrakk> \<Longrightarrow> \<lbrace>?R4127 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> resetUntypedCap cref \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4120 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s. inr_rrel dc (Inr rv) (xfdc s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (status_' s)) (errstate s) \<longrightarrow> s \<in> UNIV))}
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; \<not> reset\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4100 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)) (?T4102 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) [SKIP] (whenE reset (resetUntypedCap cref)) SKIP
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(object_type_from_H newType,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== word_of_nat (length destSlots) << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),\<acute>freeRef - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv) (?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv') [SKIP] (liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, -
 8. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v))),UNIV
 9. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and ?R4127 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase) a) \<and> (\<not> reset \<longrightarrow> ?R4100 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase a)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'4120 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v) \<and> (\<not> reset \<longrightarrow> s \<in> ?T4102 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v)} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset\<rbrakk> \<Longrightarrow> \<lbrace>?R4127 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> resetUntypedCap cref \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4120 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s. inr_rrel dc (Inr rv) (xfdc s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (status_' s)) (errstate s) \<longrightarrow> s \<in> UNIV))}
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; \<not> reset\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4100 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)) (?T4102 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) [SKIP] (whenE reset (resetUntypedCap cref)) SKIP
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(object_type_from_H newType,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== word_of_nat (length destSlots) << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),\<acute>freeRef - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv) (?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv') [SKIP] (liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, -
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v))),UNIV
 8. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and ?R4127 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase) a) \<and> (\<not> reset \<longrightarrow> ?R4100 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase a)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'4120 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v) \<and> (\<not> reset \<longrightarrow> s \<in> ?T4102 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v)} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) true; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; reset\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4120 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) true) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref) {s. (id (status_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (status_' s)) \<longrightarrow> s \<in> {s. inr_rrel dc (Inr rv) (xfdc s)})) \<and> (id (status_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (status_' s)) (errstate s) \<longrightarrow> s \<in> UNIV))}
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; \<not> reset\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4100 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)) (?T4102 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) [SKIP] (whenE reset (resetUntypedCap cref)) SKIP
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(object_type_from_H newType,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== word_of_nat (length destSlots) << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),\<acute>freeRef - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv) (?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv') [SKIP] (liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, -
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v))),UNIV
 7. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> ?R4100 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase a)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> ?R'4120 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v) \<and> (\<not> reset \<longrightarrow> s \<in> ?T4102 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v)} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; \<not> reset\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4100 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)) (?T4102 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) [SKIP] (whenE reset (resetUntypedCap cref)) SKIP
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(object_type_from_H newType,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== word_of_nat (length destSlots) << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),\<acute>freeRef - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv) (?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv') [SKIP] (liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, -
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v))),UNIV
 6. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> ?R4100 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase a)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> ?T4102 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v)} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = SCAST(32 signed \<rightarrow> 32) false; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; \<not> reset\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (cintr \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?R4100 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr cref) (PTR(unit) ptr)) (?T4102 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (SCAST(32 signed \<rightarrow> 32) false) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) [SKIP] (returnOk ()) SKIP
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(object_type_from_H newType,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== word_of_nat (length destSlots) << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),\<acute>freeRef - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv) (?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv') [SKIP] (liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, -
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v))),UNIV
 6. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> ?R4100 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase a)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> ?T4102 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v)} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(object_type_from_H newType,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== word_of_nat (length destSlots) << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),\<acute>freeRef - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv) (?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv') [SKIP] (liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)) (?d'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv')
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, -
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v))),UNIV
 5. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv) (?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv rv') [SKIP] (liftE (do y <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
y <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
createNewObjects newType cref destSlots ptr us isdev
od)) (\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(object_type_from_H newType,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== word_of_nat (length destSlots) << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),\<acute>freeRef - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, -
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v))),UNIV
 4. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4084 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()) (?Q'4084 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv') [SKIP] (do x <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
x <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (\<acute>ret__unsigned_long :== CALL getObjectSize_'proc(object_type_from_H newType,userSize);;
(Guard ShiftError \<lbrace>\<acute>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== word_of_nat (length destSlots) << unat \<acute>ret__unsigned_long);;
(\<acute>freeRef :== ptr + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),\<acute>freeRef - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, -
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v))),UNIV
 4. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4084 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()) (?G'4314 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) [SKIP] (do x <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
x <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (Guard ShiftError \<lbrace>ret__unsigned_long < 0x20\<rbrace> (\<acute>totalObjectSize :== word_of_nat (length destSlots) << unat ret__unsigned_long);;
(\<acute>freeRef :== ptr + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),\<acute>freeRef - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, -
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> ?G'4314 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 4. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4084 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()) (?C'4479 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) [SKIP] (do x <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
x <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (\<acute>totalObjectSize :== word_of_nat (length destSlots) << unat ret__unsigned_long;;
(\<acute>freeRef :== ptr + \<acute>totalObjectSize;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),\<acute>freeRef - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, -
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> ?C'4479 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 4. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4084 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()) (?G'4491 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) [SKIP] (do x <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
x <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (\<acute>freeRef :== ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),\<acute>freeRef - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, -
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> ?G'4491 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 4. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4084 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()) (?G'4634 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) [SKIP] (do x <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
x <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>?Q4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<rbrace>, -
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> ?G'4634 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 4. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A4755 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()) (?C'4752 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) [SKIP] (do x <- stateAssert (\<lambda>s. \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1)) [];
x <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. ?A4755 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> ?C'4752 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 4. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4759 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()) (?C'4752 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) [SKIP] (do x <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ?P4759 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> ?C'4752 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 4. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P'4768 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()) (?Q4766 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) [SKIP] (do x <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and ?P'4768 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> ?Q4766 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 4. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P'4768 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()) (?Q4766 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) [SKIP] (do x <- updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))));
r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C)));;
(CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and ?P'4768 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> ?Q4766 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 4. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4784 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()) (?P'4777 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) [SKIP] (updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (\<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv) (?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a) [SKIP] (do r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<lbrace>?R4782 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()\<rbrace> updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) \<lbrace>?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<rbrace>
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv (xfdc s)}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (?P4784 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a and ?R4782 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a)) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> ?P'4777 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 8. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile> ({s} \<inter> {s. \<exists>cte cte'. cslift s (cte_Ptr cref) = Some cte' \<and> cteCap cte = capability.UntypedCap isdev ptr_base sz (if reset then 0 else idx) \<and> ccte_relation cte cte'}) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {t. \<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cte_Ptr cref))))\<lparr>capFreeIndex_CL := word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr cref) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cte_Ptr cref))))) (t_hrs_' (globals s)) \<and> t may_only_modify_globals s in [t_hrs]}
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv) (?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a) [SKIP] (do r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<lbrace>?R4782 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()\<rbrace> updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) \<lbrace>?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<rbrace>
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv (xfdc s)}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and ?R4782 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a)) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 8. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long s. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> {s} \<inter> {s. \<exists>cte cte'. cslift s (cte_Ptr cref) = Some cte' \<and> cteCap cte = capability.UntypedCap isdev ptr_base sz (if reset then 0 else idx) \<and> ccte_relation cte cte'} \<subseteq> {sa. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> sa \<Turnstile>\<^sub>c cte_Ptr cref \<and> (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C (the (cslift s (cte_Ptr cref))))\<lparr>capFreeIndex_CL := word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals sa)) = hrs_mem_update (heap_update (cte_Ptr cref) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cte_Ptr cref))))) (t_hrs_' (globals s)) \<and> globals sa may_only_modify_globals s in [t_hrs]))}
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv) (?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a) [SKIP] (do r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<lbrace>?R4782 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()\<rbrace> updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) \<lbrace>?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<rbrace>
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv (xfdc s)}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and ?R4782 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a)) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 8. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>userSize s cte cte'. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; us = unat userSize; cslift s (cte_Ptr cref) = Some cte'; cteCap cte = capability.UntypedCap isdev ptr_base sz (if reset then 0 else idx); ccte_relation cte cte'\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := (ptr + (word_of_nat (length destSlots) << unat (word_of_nat (APIType_capBits newType (unat userSize)))) - ptr_base >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> hrs_mem_update (heap_update (cte_Ptr cref) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' t) cte')) (t_hrs_' (globals s)) = hrs_mem_update (heap_update (cte_Ptr cref) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals s)) \<and> globals s may_only_modify_globals s in [t_hrs]))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv) (?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a) [SKIP] (do r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<lbrace>?R4782 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()\<rbrace> updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) \<lbrace>?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<rbrace>
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv (xfdc s)}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and ?R4782 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a)) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 8. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>userSize s cte cte'. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; us = unat userSize; cslift s (cte_Ptr cref) = Some cte'; cteCap cte = capability.UntypedCap isdev ptr_base sz (if reset then 0 else idx); ccte_relation cte cte'; ccap_relation (cteCap cte) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := (ptr + (word_of_nat (length destSlots) << unat (word_of_nat (APIType_capBits newType (unat userSize)))) - ptr_base >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> hrs_mem_update (heap_update (cte_Ptr cref) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' t) cte')) (t_hrs_' (globals s)) = hrs_mem_update (heap_update (cte_Ptr cref) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals s)) \<and> globals s may_only_modify_globals s in [t_hrs]))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv) (?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a) [SKIP] (do r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<lbrace>?R4782 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()\<rbrace> updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) \<lbrace>?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<rbrace>
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv (xfdc s)}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and ?R4782 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a)) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 8. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>userSize s cte cte'. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; us = unat userSize; cslift s (cte_Ptr cref) = Some cte'; cteCap cte = capability.UntypedCap isdev ptr_base sz (if reset then 0 else idx); ccte_relation cte cte'; ccap_relation (capability.UntypedCap isdev ptr_base sz (if reset then 0 else idx)) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := (ptr + (word_of_nat (length destSlots) << unat (word_of_nat (APIType_capBits newType (unat userSize)))) - ptr_base >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> hrs_mem_update (heap_update (cte_Ptr cref) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' t) cte')) (t_hrs_' (globals s)) = hrs_mem_update (heap_update (cte_Ptr cref) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals s)) \<and> globals s may_only_modify_globals s in [t_hrs]))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv) (?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a) [SKIP] (do r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<lbrace>?R4782 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()\<rbrace> updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) \<lbrace>?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<rbrace>
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv (xfdc s)}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and ?R4782 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a)) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 8. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>userSize s cte cte'. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; us = unat userSize; cslift s (cte_Ptr cref) = Some cte'; cteCap cte = capability.UntypedCap isdev ptr_base sz (if reset then 0 else idx); ccte_relation cte cte'; ccap_relation (capability.UntypedCap isdev ptr_base sz (if reset then 0 else idx)) (cte_C.cap_C cte'); cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := (ptr + (word_of_nat (length destSlots) << unat (word_of_nat (APIType_capBits newType (unat userSize)))) - ptr_base >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> hrs_mem_update (heap_update (cte_Ptr cref) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' t) cte')) (t_hrs_' (globals s)) = hrs_mem_update (heap_update (cte_Ptr cref) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals s)) \<and> globals s may_only_modify_globals s in [t_hrs]))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv) (?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a) [SKIP] (do r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<lbrace>?R4782 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()\<rbrace> updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) \<lbrace>?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<rbrace>
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv (xfdc s)}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and ?R4782 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a)) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 8. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>userSize s cte cte'. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; us = unat userSize; cslift s (cte_Ptr cref) = Some cte'; cteCap cte = capability.UntypedCap isdev ptr_base sz (if reset then 0 else idx); ccte_relation cte cte'; ccap_relation (capability.UntypedCap isdev ptr_base sz (if reset then 0 else idx)) (cte_C.cap_C cte'); cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; (ptr + (word_of_nat (length destSlots) << unat (word_of_nat (APIType_capBits newType us))) - ptr_base >> 4) && mask 26 = word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) >> 4\<rbrakk> \<Longrightarrow> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := (ptr + (word_of_nat (length destSlots) << unat (word_of_nat (APIType_capBits newType (unat userSize)))) - ptr_base >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> (\<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> hrs_mem_update (heap_update (cte_Ptr cref) (cte_C.cap_C_update (\<lambda>_. ret__struct_cap_C_' t) cte')) (t_hrs_' (globals s)) = hrs_mem_update (heap_update (cte_Ptr cref) (cte_C.cap_C_update (\<lambda>_. cap) cte')) (t_hrs_' (globals s)) \<and> globals s may_only_modify_globals s in [t_hrs]))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv) (?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a) [SKIP] (do r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<lbrace>?R4782 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()\<rbrace> updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) \<lbrace>?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<rbrace>
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv (xfdc s)}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and ?R4782 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a)) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 8. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>userSize s cte x1 x2 t. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; us = unat userSize; cslift s (cte_Ptr cref) = Some (cte_C x1 x2); cteCap cte = capability.UntypedCap isdev ptr_base sz (if reset then 0 else idx); ccte_relation cte (cte_C x1 x2); ccap_relation (capability.UntypedCap isdev ptr_base sz (if reset then 0 else idx)) x1; cap_get_tag x1 = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; (ptr + (word_of_nat (length destSlots) << unat (word_of_nat (APIType_capBits newType (unat userSize)))) - ptr_base >> 4) && mask 26 = word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) >> 4; cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift x1\<lparr>capFreeIndex_CL := word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) >> 4\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift x1\<lparr>capFreeIndex_CL := word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> hrs_mem_update (heap_update (cte_Ptr cref) (cte_C (ret__struct_cap_C_' t) x2)) (t_hrs_' (globals s)) = hrs_mem_update (heap_update (cte_Ptr cref) (cte_C cap x2)) (t_hrs_' (globals s)) \<and> globals s may_only_modify_globals s in [t_hrs]
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv) (?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a) [SKIP] (do r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<lbrace>?R4782 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()\<rbrace> updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) \<lbrace>?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<rbrace>
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv (xfdc s)}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and ?R4782 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a)) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 8. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>userSize s cte x1 x2 t. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; us = unat userSize; cslift s (cte_Ptr cref) = Some (cte_C x1 x2); cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); ccte_relation cte (cte_C x1 x2); ccap_relation (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) x1; cap_get_tag x1 = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; (ptr + (word_of_nat (length destSlots) << unat (word_of_nat (APIType_capBits newType (unat userSize)))) - (ptr && ~~ mask sz) >> 4) && mask 26 = word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) >> 4; cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift x1\<lparr>capFreeIndex_CL := word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) >> 4\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<exists>cap. cap_untyped_cap_lift cap = cap_untyped_cap_lift x1\<lparr>capFreeIndex_CL := word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) >> 4\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> hrs_mem_update (heap_update (cte_Ptr cref) (cte_C (ret__struct_cap_C_' t) x2)) (t_hrs_' (globals s)) = hrs_mem_update (heap_update (cte_Ptr cref) (cte_C cap x2)) (t_hrs_' (globals s)) \<and> (\<exists>t_hrs_'. t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t))) (globals s) = globals s\<lparr>t_hrs_' := t_hrs_'\<rparr>)
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv) (?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a) [SKIP] (do r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<lbrace>?R4782 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()\<rbrace> updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) \<lbrace>?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<rbrace>
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv (xfdc s)}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and ?R4782 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a)) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 8. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>userSize s cte x1 x2 t. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; us = unat userSize; cslift s (cte_Ptr cref) = Some (cte_C x1 x2); cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); ccte_relation cte (cte_C x1 x2); ccap_relation (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx)) x1; cap_get_tag x1 = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; (ptr + (word_of_nat (length destSlots) << unat (word_of_nat (APIType_capBits newType (unat userSize)))) - (ptr && ~~ mask sz) >> 4) && mask 26 = word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) >> 4; cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift x1\<lparr>capFreeIndex_CL := word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) >> 4\<rparr>; cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> \<exists>t_hrs_'. t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t))) (globals s) = globals s\<lparr>t_hrs_' := t_hrs_'\<rparr>
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv) (?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a) [SKIP] (do r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<lbrace>?R4782 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()\<rbrace> updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) \<lbrace>?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<rbrace>
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv (xfdc s)}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and ?R4782 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a)) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 8. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a t t'. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv) (?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a) [SKIP] (do r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (?d'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv'a)
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<lbrace>?R4782 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()\<rbrace> updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) \<lbrace>?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<rbrace>
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv (xfdc s)}
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and ?R4782 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a)) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 7. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv) (?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a) [SKIP] (do r <- createNewObjects newType cref destSlots ptr us isdev;
return (Inr ())
od) (CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<lbrace>?R4782 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()\<rbrace> updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) \<lbrace>?Q4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<rbrace>
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv (xfdc s)}
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and ?R4782 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a)) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 6. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a rva xfdc. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4883 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a rva) (?Q'4883 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a rva xfdc) [SKIP] (return (Inr ())) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R4885 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv\<rbrace> createNewObjects newType cref destSlots ptr us isdev \<lbrace>?Q4883 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a\<rbrace>
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4883 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a) CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> ?Q'4883 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a rva (xfdc s)}
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<lbrace>?R4782 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()\<rbrace> updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) \<lbrace>\<lambda>rv. invs' and sch_act_simple and ct_active' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) cref and (\<lambda>s. \<forall>slot\<in>set destSlots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and (\<lambda>s. \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) and (\<lambda>s. \<exists>n. gsCNodes s cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and caps_overlap_reserved' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ getObjectSize newType us - 1} and (\<lambda>s. descendants_range_in' {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} cref (ctes_of s)) and cnodes_retype_have_size {ptr..ptr + word_of_nat (length destSlots) * 2 ^ getObjectSize newType us - 1} (APIType_capBits newType us) \<circ> gsCNodes and K (cref \<notin> set destSlots \<and> destSlots \<noteq> [] \<and> range_cover ptr sz (getObjectSize newType us) (length destSlots) \<and> ptr \<noteq> 0 \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ getObjectSize newType us - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType us) - 1} \<and> 0 \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> is_aligned ptr 4 \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) \<and> unat (word_of_nat (length destSlots)) = length destSlots) and ?R4885 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv\<rbrace>
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. deviceMemory_'_update (\<lambda>_. from_bool isdev) (userSize_'_update (\<lambda>_. userSize) (regionBase_'_update (\<lambda>_. PTR(unit) ptr) (destLength_'_update (\<lambda>_. word_of_nat (length destSlots)) (destOffset_'_update (\<lambda>_. start) (destCNode_'_update (\<lambda>_. cte_Ptr cnodeptr) (parent_'_update (\<lambda>_. cte_Ptr cref) (t_'_update (\<lambda>_. object_type_from_H newType) s))))))) \<in> {s. \<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0} \<inter> \<lbrace>\<acute>t = object_type_from_H newType\<rbrace> \<inter> \<lbrace>\<acute>parent = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 0x10)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots) \<and> unat (word_of_nat (length destSlots)) \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>regionBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = isdev\<rbrace>} \<inter> ?R'4883 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv (xfdc s)}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and ?R4782 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a)) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 8. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a rva xfdc. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a; dc rva xfdc\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (cintr \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R4885 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv\<rbrace> createNewObjects newType cref destSlots ptr us isdev \<lbrace>\<lambda>rva _. True\<rbrace>
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4883 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a) CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<lbrace>?R4782 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()\<rbrace> updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) \<lbrace>\<lambda>rv. invs' and sch_act_simple and ct_active' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) cref and (\<lambda>s. \<forall>slot\<in>set destSlots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and (\<lambda>s. \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) and (\<lambda>s. \<exists>n. gsCNodes s cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and caps_overlap_reserved' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ getObjectSize newType us - 1} and (\<lambda>s. descendants_range_in' {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} cref (ctes_of s)) and cnodes_retype_have_size {ptr..ptr + word_of_nat (length destSlots) * 2 ^ getObjectSize newType us - 1} (APIType_capBits newType us) \<circ> gsCNodes and K (cref \<notin> set destSlots \<and> destSlots \<noteq> [] \<and> range_cover ptr sz (getObjectSize newType us) (length destSlots) \<and> ptr \<noteq> 0 \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ getObjectSize newType us - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType us) - 1} \<and> 0 \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> is_aligned ptr 4 \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) \<and> unat (word_of_nat (length destSlots)) = length destSlots) and ?R4885 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv\<rbrace>
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. deviceMemory_'_update (\<lambda>_. from_bool isdev) (userSize_'_update (\<lambda>_. userSize) (regionBase_'_update (\<lambda>_. PTR(unit) ptr) (destLength_'_update (\<lambda>_. word_of_nat (length destSlots)) (destOffset_'_update (\<lambda>_. start) (destCNode_'_update (\<lambda>_. cte_Ptr cnodeptr) (parent_'_update (\<lambda>_. cte_Ptr cref) (t_'_update (\<lambda>_. object_type_from_H newType) s))))))) \<in> {s. \<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0} \<inter> \<lbrace>\<acute>t = object_type_from_H newType\<rbrace> \<inter> \<lbrace>\<acute>parent = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 0x10)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots) \<and> unat (word_of_nat (length destSlots)) \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>regionBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = isdev\<rbrace>} \<inter> ?R'4883 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv (xfdc s)}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and ?R4782 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a)) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 8. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a rva xfdc \<sigma>. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a; dc rva xfdc\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (cintr \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>))}
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R4885 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv\<rbrace> createNewObjects newType cref destSlots ptr us isdev \<lbrace>\<lambda>rva _. True\<rbrace>
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4883 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a) CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<lbrace>?R4782 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()\<rbrace> updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) \<lbrace>\<lambda>rv. invs' and sch_act_simple and ct_active' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) cref and (\<lambda>s. \<forall>slot\<in>set destSlots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and (\<lambda>s. \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) and (\<lambda>s. \<exists>n. gsCNodes s cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and caps_overlap_reserved' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ getObjectSize newType us - 1} and (\<lambda>s. descendants_range_in' {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} cref (ctes_of s)) and cnodes_retype_have_size {ptr..ptr + word_of_nat (length destSlots) * 2 ^ getObjectSize newType us - 1} (APIType_capBits newType us) \<circ> gsCNodes and K (cref \<notin> set destSlots \<and> destSlots \<noteq> [] \<and> range_cover ptr sz (getObjectSize newType us) (length destSlots) \<and> ptr \<noteq> 0 \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ getObjectSize newType us - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType us) - 1} \<and> 0 \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> is_aligned ptr 4 \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) \<and> unat (word_of_nat (length destSlots)) = length destSlots) and ?R4885 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv\<rbrace>
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. deviceMemory_'_update (\<lambda>_. from_bool isdev) (userSize_'_update (\<lambda>_. userSize) (regionBase_'_update (\<lambda>_. PTR(unit) ptr) (destLength_'_update (\<lambda>_. word_of_nat (length destSlots)) (destOffset_'_update (\<lambda>_. start) (destCNode_'_update (\<lambda>_. cte_Ptr cnodeptr) (parent_'_update (\<lambda>_. cte_Ptr cref) (t_'_update (\<lambda>_. object_type_from_H newType) s))))))) \<in> {s. \<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0} \<inter> \<lbrace>\<acute>t = object_type_from_H newType\<rbrace> \<inter> \<lbrace>\<acute>parent = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 0x10)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots) \<and> unat (word_of_nat (length destSlots)) \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>regionBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = isdev\<rbrace>} \<inter> ?R'4883 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv (xfdc s)}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and ?R4782 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a)) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 8. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R4885 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv\<rbrace> createNewObjects newType cref destSlots ptr us isdev \<lbrace>\<lambda>rva _. True\<rbrace>
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4883 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a) CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<lbrace>?R4782 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()\<rbrace> updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) \<lbrace>\<lambda>rv. invs' and sch_act_simple and ct_active' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) cref and (\<lambda>s. \<forall>slot\<in>set destSlots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and (\<lambda>s. \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) and (\<lambda>s. \<exists>n. gsCNodes s cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and caps_overlap_reserved' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ getObjectSize newType us - 1} and (\<lambda>s. descendants_range_in' {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} cref (ctes_of s)) and cnodes_retype_have_size {ptr..ptr + word_of_nat (length destSlots) * 2 ^ getObjectSize newType us - 1} (APIType_capBits newType us) \<circ> gsCNodes and K (cref \<notin> set destSlots \<and> destSlots \<noteq> [] \<and> range_cover ptr sz (getObjectSize newType us) (length destSlots) \<and> ptr \<noteq> 0 \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ getObjectSize newType us - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType us) - 1} \<and> 0 \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> is_aligned ptr 4 \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) \<and> unat (word_of_nat (length destSlots)) = length destSlots) and ?R4885 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv\<rbrace>
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. deviceMemory_'_update (\<lambda>_. from_bool isdev) (userSize_'_update (\<lambda>_. userSize) (regionBase_'_update (\<lambda>_. PTR(unit) ptr) (destLength_'_update (\<lambda>_. word_of_nat (length destSlots)) (destOffset_'_update (\<lambda>_. start) (destCNode_'_update (\<lambda>_. cte_Ptr cnodeptr) (parent_'_update (\<lambda>_. cte_Ptr cref) (t_'_update (\<lambda>_. object_type_from_H newType) s))))))) \<in> {s. \<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0} \<inter> \<lbrace>\<acute>t = object_type_from_H newType\<rbrace> \<inter> \<lbrace>\<acute>parent = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 0x10)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots) \<and> unat (word_of_nat (length destSlots)) \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>regionBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = isdev\<rbrace>} \<inter> ?R'4883 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv (xfdc s)}
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and ?R4782 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a)) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 7. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize)); dc rv rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4883 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv rv'a) CALL createNewObjects_'proc(object_type_from_H newType,cte_Ptr cref,cte_Ptr cnodeptr,start,word_of_nat (length destSlots),PTR(unit) ptr,userSize,from_bool isdev) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<lbrace>?R4782 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()\<rbrace> updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) \<lbrace>\<lambda>rv. invs' and sch_act_simple and ct_active' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) cref and (\<lambda>s. \<forall>slot\<in>set destSlots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and (\<lambda>s. \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) and (\<lambda>s. \<exists>n. gsCNodes s cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and caps_overlap_reserved' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ getObjectSize newType us - 1} and (\<lambda>s. descendants_range_in' {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} cref (ctes_of s)) and cnodes_retype_have_size {ptr..ptr + word_of_nat (length destSlots) * 2 ^ getObjectSize newType us - 1} (APIType_capBits newType us) \<circ> gsCNodes and K (cref \<notin> set destSlots \<and> destSlots \<noteq> [] \<and> range_cover ptr sz (getObjectSize newType us) (length destSlots) \<and> ptr \<noteq> 0 \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ getObjectSize newType us - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType us) - 1} \<and> 0 \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> is_aligned ptr 4 \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) \<and> unat (word_of_nat (length destSlots)) = length destSlots) and (\<lambda>a. True)\<rbrace>
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. deviceMemory_'_update (\<lambda>_. from_bool isdev) (userSize_'_update (\<lambda>_. userSize) (regionBase_'_update (\<lambda>_. PTR(unit) ptr) (destLength_'_update (\<lambda>_. word_of_nat (length destSlots)) (destOffset_'_update (\<lambda>_. start) (destCNode_'_update (\<lambda>_. cte_Ptr cnodeptr) (parent_'_update (\<lambda>_. cte_Ptr cref) (t_'_update (\<lambda>_. object_type_from_H newType) s))))))) \<in> {s. \<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0} \<inter> \<lbrace>\<acute>t = object_type_from_H newType\<rbrace> \<inter> \<lbrace>\<acute>parent = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 0x10)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots) \<and> unat (word_of_nat (length destSlots)) \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>regionBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = isdev\<rbrace>} \<inter> ?R'4883 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long rv (xfdc s)}
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and ?R4782 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a)) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 6. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<lbrace>?R4782 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()\<rbrace> updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) \<lbrace>\<lambda>rv. invs' and sch_act_simple and ct_active' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) cref and (\<lambda>s. \<forall>slot\<in>set destSlots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and (\<lambda>s. \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) and (\<lambda>s. \<exists>n. gsCNodes s cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and caps_overlap_reserved' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ getObjectSize newType us - 1} and (\<lambda>s. descendants_range_in' {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} cref (ctes_of s)) and cnodes_retype_have_size {ptr..ptr + word_of_nat (length destSlots) * 2 ^ getObjectSize newType us - 1} (APIType_capBits newType us) \<circ> gsCNodes and K (cref \<notin> set destSlots \<and> destSlots \<noteq> [] \<and> range_cover ptr sz (getObjectSize newType us) (length destSlots) \<and> ptr \<noteq> 0 \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ getObjectSize newType us - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType us) - 1} \<and> 0 \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> is_aligned ptr 4 \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) \<and> unat (word_of_nat (length destSlots)) = length destSlots) and (\<lambda>a. True)\<rbrace>
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. deviceMemory_'_update (\<lambda>_. from_bool isdev) (userSize_'_update (\<lambda>_. userSize) (regionBase_'_update (\<lambda>_. PTR(unit) ptr) (destLength_'_update (\<lambda>_. word_of_nat (length destSlots)) (destOffset_'_update (\<lambda>_. start) (destCNode_'_update (\<lambda>_. cte_Ptr cnodeptr) (parent_'_update (\<lambda>_. cte_Ptr cref) (t_'_update (\<lambda>_. object_type_from_H newType) s))))))) \<in> {s. \<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0} \<inter> \<lbrace>\<acute>t = object_type_from_H newType\<rbrace> \<inter> \<lbrace>\<acute>parent = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 0x10)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots) \<and> unat (word_of_nat (length destSlots)) \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>regionBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = isdev\<rbrace>} \<inter> \<lbrace>True\<rbrace>}
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and ?R4782 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a)) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 5. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType us)\<rbrakk> \<Longrightarrow> \<lbrace>?R4782 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base ()\<rbrace> updateFreeIndex cref (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) \<lbrace>\<lambda>rv. invs' and sch_act_simple and ct_active' and cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) cref and (\<lambda>s. \<forall>slot\<in>set destSlots. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) slot s) and (\<lambda>s. \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s) and (\<lambda>s. \<exists>n. gsCNodes s cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) and pspace_no_overlap' ptr sz and caps_no_overlap'' ptr sz and caps_overlap_reserved' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} and (\<lambda>s. descendants_range_in' {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} cref (ctes_of s)) and cnodes_retype_have_size {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} (APIType_capBits newType us) \<circ> gsCNodes and (\<lambda>y. cref \<notin> set destSlots \<and> destSlots \<noteq> [] \<and> range_cover ptr sz (APIType_capBits newType us) (length destSlots) \<and> ptr \<noteq> 0 \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType us) - 1} \<and> 0 \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> is_aligned ptr 4 \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) \<and> unat (word_of_nat (length destSlots)) = length destSlots)\<rbrace>
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' ret__unsigned_long) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat ret__unsigned_long) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. deviceMemory_'_update (\<lambda>_. from_bool isdev) (userSize_'_update (\<lambda>_. userSize) (regionBase_'_update (\<lambda>_. PTR(unit) ptr) (destLength_'_update (\<lambda>_. word_of_nat (length destSlots)) (destOffset_'_update (\<lambda>_. start) (destCNode_'_update (\<lambda>_. cte_Ptr cnodeptr) (parent_'_update (\<lambda>_. cte_Ptr cref) (t_'_update (\<lambda>_. object_type_from_H newType) s))))))) \<in> {s. \<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0} \<inter> \<lbrace>\<acute>t = object_type_from_H newType\<rbrace> \<inter> \<lbrace>\<acute>parent = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 0x10)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots) \<and> unat (word_of_nat (length destSlots)) \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>regionBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>to_bool \<acute>deviceMemory = isdev\<rbrace>} \<inter> \<lbrace>True\<rbrace>}
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>b. \<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and ?R4782 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch a)) b) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 5. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv' ret__unsigned_long. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; ret__unsigned_long = word_of_nat (APIType_capBits newType us)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base rv' (word_of_nat (APIType_capBits newType us))\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' (word_of_nat (APIType_capBits newType us))) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat (word_of_nat (APIType_capBits newType us))) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10) \<and> 0 < unat (word_of_nat (length destSlots))}
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>a. \<not> cNodeOverlap (gsCNodes a) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) minUntypedSizeBits) \<circ> cteCap) cref a) \<and> sch_act_simple a \<and> ct_active' a \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cref = cref then capFreeIndex_update (\<lambda>_. getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) else id) c) = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) cref a \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) else id) c) = capability.NullCap) x a) \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (isUntypedCap \<circ> cteCap) cref a \<and> ex_cte_cap_wp_to' (\<lambda>a. True) x a) \<and> (\<exists>n. gsCNodes a cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) \<and> (pspace_no_overlap' ptr sz a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) cref a) \<and> (caps_no_overlap'' ptr sz a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) cref a) \<and> (valid_pspace' a \<and> descendants_range_in' {ptr..ptr + destLength * 2 ^ APIType_capBits newType us - 1} cref (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + destLength * 2 ^ APIType_capBits newType us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) cap) \<inter> {ptr..ptr + destLength * 2 ^ APIType_capBits newType us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) cref a) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) cref a \<and> descendants_range_in' {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} cref (ctes_of a)) \<and> cnodes_retype_have_size {ptr..ptr + destLength * 2 ^ APIType_capBits newType us - 1} (APIType_capBits newType us) (gsCNodes a) \<and> cref \<notin> set destSlots \<and> destSlots \<noteq> [] \<and> range_cover ptr sz (APIType_capBits newType us) (length destSlots) \<and> ptr \<noteq> 0 \<and> {ptr..ptr + destLength * 2 ^ APIType_capBits newType us - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (destLength << APIType_capBits newType us) - 1} \<and> 0 \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> is_aligned ptr 4 \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) \<and> unat destLength = length destSlots))) a) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 4. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>userSize rv'. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; us = unat userSize\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4775 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base rv' (word_of_nat (APIType_capBits newType (unat userSize)))\<^esub> (?R'4776 (word_of_nat (length destSlots)) (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base () rv' (word_of_nat (APIType_capBits newType (unat userSize)))) \<acute>ret__struct_cap_C :== CALL cap_untyped_cap_set_capFreeIndex_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])),ptr + (word_of_nat (length destSlots) << unat (word_of_nat (APIType_capBits newType (unat userSize)))) - ptr_base >> 4);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr cref} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])) \<acute>ret__struct_cap_C))) {s. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10)}
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>a. \<not> cNodeOverlap (gsCNodes a) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) minUntypedSizeBits) \<circ> cteCap) cref a) \<and> sch_act_simple a \<and> ct_active' a \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cref = cref then capFreeIndex_update (\<lambda>_. getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) else id) c) = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) cref a \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) else id) c) = capability.NullCap) x a) \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (isUntypedCap \<circ> cteCap) cref a \<and> ex_cte_cap_wp_to' (\<lambda>a. True) x a) \<and> (\<exists>n. gsCNodes a cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) \<and> (pspace_no_overlap' ptr sz a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) cref a) \<and> (caps_no_overlap'' ptr sz a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) cref a) \<and> (valid_pspace' a \<and> descendants_range_in' {ptr..ptr + destLength * 2 ^ APIType_capBits newType us - 1} cref (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + destLength * 2 ^ APIType_capBits newType us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) cap) \<inter> {ptr..ptr + destLength * 2 ^ APIType_capBits newType us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) cref a) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) cref a \<and> descendants_range_in' {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} cref (ctes_of a)) \<and> cnodes_retype_have_size {ptr..ptr + destLength * 2 ^ APIType_capBits newType us - 1} (APIType_capBits newType us) (gsCNodes a) \<and> cref \<notin> set destSlots \<and> destSlots \<noteq> [] \<and> range_cover ptr sz (APIType_capBits newType us) (length destSlots) \<and> ptr \<noteq> 0 \<and> {ptr..ptr + destLength * 2 ^ APIType_capBits newType us - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (destLength << APIType_capBits newType us) - 1} \<and> 0 \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> is_aligned ptr 4 \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) \<and> unat destLength = length destSlots))) a) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>va v'. va = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := va\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat va) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat va)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> ?R'4776 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch (theRight v) a va} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>va < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 4. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a. (\<lambda>a. \<not> cNodeOverlap (gsCNodes a) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> ((\<lambda>s. invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s) and (valid_objs' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx) = cteCap cte) cref and untyped_ranges_zero' and (\<lambda>_. is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx))) and (\<lambda>a. (invs' a \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<and> getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) minUntypedSizeBits) \<circ> cteCap) cref a) \<and> sch_act_simple a \<and> ct_active' a \<and> cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if cref = cref then capFreeIndex_update (\<lambda>_. getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) else id) c) = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) cref a \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (\<lambda>c. cteCap (cteCap_update (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) else id) c) = capability.NullCap) x a) \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (isUntypedCap \<circ> cteCap) cref a \<and> ex_cte_cap_wp_to' (\<lambda>a. True) x a) \<and> (\<exists>n. gsCNodes a cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) \<and> (pspace_no_overlap' ptr sz a \<and> valid_pspace' a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) cref a) \<and> (caps_no_overlap'' ptr sz a \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) cref a) \<and> (valid_pspace' a \<and> descendants_range_in' {ptr..ptr + destLength * 2 ^ APIType_capBits newType us - 1} cref (ctes_of a) \<and> cte_wp_at' ((\<lambda>cap. {ptr..ptr + destLength * 2 ^ APIType_capBits newType us - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) cap) \<inter> {ptr..ptr + destLength * 2 ^ APIType_capBits newType us - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) cref a) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) cref a \<and> descendants_range_in' {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} cref (ctes_of a)) \<and> cnodes_retype_have_size {ptr..ptr + destLength * 2 ^ APIType_capBits newType us - 1} (APIType_capBits newType us) (gsCNodes a) \<and> cref \<notin> set destSlots \<and> destSlots \<noteq> [] \<and> range_cover ptr sz (APIType_capBits newType us) (length destSlots) \<and> ptr \<noteq> 0 \<and> {ptr..ptr + destLength * 2 ^ APIType_capBits newType us - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (destLength << APIType_capBits newType us) - 1} \<and> 0 \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> is_aligned ptr 4 \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) \<and> unat destLength = length destSlots))) a) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)\<rbrace>, -
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?R4093 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>a b. (\<not> cNodeOverlap (gsCNodes b) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> invs' b \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref b \<and> valid_objs' b \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_base sz (if reset then 0 else idx) = cteCap cte) cref b \<and> untyped_ranges_zero' b \<and> is_aligned (word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ sz \<and> invs' b \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<and> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) minUntypedSizeBits) cref b \<and> sch_act_simple b \<and> ct_active' b \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (cteCap c) = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) cref b \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (\<lambda>c. (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) else id) (cteCap c) = capability.NullCap) x b) \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref b \<and> ex_cte_cap_wp_to' (\<lambda>a. True) x b) \<and> (\<exists>n. gsCNodes b cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) \<and> pspace_no_overlap' ptr sz b \<and> valid_pspace' b \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref b \<and> caps_no_overlap'' ptr sz b \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref b \<and> valid_pspace' b \<and> descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} cref (ctes_of b) \<and> cte_wp_at' (\<lambda>a. {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (cteCap a)) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} = {} \<and> isUntypedCap (cteCap a)) cref b \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref b \<and> descendants_range_in' {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} cref (ctes_of b) \<and> cnodes_retype_have_size {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} (APIType_capBits newType us) (gsCNodes b) \<and> cref \<notin> set destSlots \<and> destSlots \<noteq> [] \<and> range_cover ptr sz (APIType_capBits newType us) (length destSlots) \<and> ptr \<noteq> 0 \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType us) - 1} \<and> 0 \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> is_aligned ptr 4 \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) \<and> unat (word_of_nat (length destSlots)) = length destSlots) \<and> cte_wp_at' (\<lambda>_. True) cref b\<rbrace>, -
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ?R4093 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<lbrace>?P5210 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr)\<rbrace> whenE reset (resetUntypedCap cref) \<lbrace>\<lambda>_ s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n\<rbrace>, -
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv s. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; (case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n) \<and> (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) and ct_active' and pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz) s\<rbrakk> \<Longrightarrow> (\<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_base sz (if reset then 0 else idx) = cteCap cte) cref s \<and> untyped_ranges_zero' s \<and> is_aligned (word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ sz \<and> invs' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<and> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) minUntypedSizeBits) cref s \<and> sch_act_simple s \<and> ct_active' s \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (cteCap c) = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) cref s \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (\<lambda>c. (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) else id) (cteCap c) = capability.NullCap) x s) \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> ex_cte_cap_wp_to' (\<lambda>a. True) x s) \<and> (\<exists>n. gsCNodes s cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> caps_no_overlap'' ptr sz s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} cref (ctes_of s) \<and> cte_wp_at' (\<lambda>a. {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (cteCap a)) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} = {} \<and> isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> descendants_range_in' {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} cref (ctes_of s) \<and> cnodes_retype_have_size {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} (APIType_capBits newType us) (gsCNodes s) \<and> cref \<notin> set destSlots \<and> destSlots \<noteq> [] \<and> range_cover ptr sz (APIType_capBits newType us) (length destSlots) \<and> ptr \<noteq> 0 \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType us) - 1} \<and> 0 \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> is_aligned ptr 4 \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) \<and> unat (word_of_nat (length destSlots)) = length destSlots) \<and> cte_wp_at' (\<lambda>_. True) cref s
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch e s. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; invs' s\<rbrakk> \<Longrightarrow> True
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 5. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and (?P5210 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv s. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; (case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n) \<and> (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) and ct_active' and pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz) s\<rbrakk> \<Longrightarrow> (\<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_base sz (if reset then 0 else idx) = cteCap cte) cref s \<and> untyped_ranges_zero' s \<and> is_aligned (word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ sz \<and> invs' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<and> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) minUntypedSizeBits) cref s \<and> sch_act_simple s \<and> ct_active' s \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (cteCap c) = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) cref s \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (\<lambda>c. (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) else id) (cteCap c) = capability.NullCap) x s) \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> ex_cte_cap_wp_to' (\<lambda>a. True) x s) \<and> (\<exists>n. gsCNodes s cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> caps_no_overlap'' ptr sz s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} cref (ctes_of s) \<and> cte_wp_at' (\<lambda>a. {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (cteCap a)) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} = {} \<and> isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> descendants_range_in' {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} cref (ctes_of s) \<and> cnodes_retype_have_size {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} (APIType_capBits newType us) (gsCNodes s) \<and> cref \<notin> set destSlots \<and> destSlots \<noteq> [] \<and> range_cover ptr sz (APIType_capBits newType us) (length destSlots) \<and> ptr \<noteq> 0 \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType us) - 1} \<and> 0 \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> is_aligned ptr 4 \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) \<and> unat (word_of_nat (length destSlots)) = length destSlots) \<and> cte_wp_at' (\<lambda>_. True) cref s
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch e s. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; invs' s\<rbrakk> \<Longrightarrow> True
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 4. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch e s. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; invs' s\<rbrakk> \<Longrightarrow> True
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv s. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; (case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n) \<and> (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) and ct_active' and pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz) s\<rbrakk> \<Longrightarrow> (\<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_base sz (if reset then 0 else idx) = cteCap cte) cref s \<and> untyped_ranges_zero' s \<and> is_aligned (word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ sz \<and> invs' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<and> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) minUntypedSizeBits) cref s \<and> sch_act_simple s \<and> ct_active' s \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (cteCap c) = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) cref s \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (\<lambda>c. (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) else id) (cteCap c) = capability.NullCap) x s) \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> ex_cte_cap_wp_to' (\<lambda>a. True) x s) \<and> (\<exists>n. gsCNodes s cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> caps_no_overlap'' ptr sz s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} cref (ctes_of s) \<and> cte_wp_at' (\<lambda>a. {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (cteCap a)) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} = {} \<and> isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> descendants_range_in' {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} cref (ctes_of s) \<and> cnodes_retype_have_size {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} (APIType_capBits newType us) (gsCNodes s) \<and> cref \<notin> set destSlots \<and> destSlots \<noteq> [] \<and> range_cover ptr sz (APIType_capBits newType us) (length destSlots) \<and> ptr \<noteq> 0 \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType us) - 1} \<and> 0 \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> is_aligned ptr 4 \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) \<and> unat (word_of_nat (length destSlots)) = length destSlots) \<and> cte_wp_at' (\<lambda>_. True) cref s
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 4. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv s. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; (case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n) \<and> (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) and ct_active' and pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz) s\<rbrakk> \<Longrightarrow> (\<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)) - 1) \<longrightarrow> invs' s \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_base sz (if reset then 0 else idx) = cteCap cte) cref s \<and> untyped_ranges_zero' s \<and> is_aligned (word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) 4 \<and> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ sz \<and> invs' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<and> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))) \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) minUntypedSizeBits) cref s \<and> sch_act_simple s \<and> ct_active' s \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (cteCap c) = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) cref s \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (\<lambda>c. (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) else id) (cteCap c) = capability.NullCap) x s) \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> ex_cte_cap_wp_to' (\<lambda>a. True) x s) \<and> (\<exists>n. gsCNodes s cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> caps_no_overlap'' ptr sz s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} cref (ctes_of s) \<and> cte_wp_at' (\<lambda>a. {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (cteCap a)) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} = {} \<and> isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> descendants_range_in' {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} cref (ctes_of s) \<and> cnodes_retype_have_size {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} (APIType_capBits newType us) (gsCNodes s) \<and> cref \<notin> set destSlots \<and> destSlots \<noteq> [] \<and> range_cover ptr sz (APIType_capBits newType us) (length destSlots) \<and> ptr \<noteq> 0 \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType us) - 1} \<and> 0 \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> is_aligned ptr 4 \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> us \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) \<and> unat (word_of_nat (length destSlots)) = length destSlots) \<and> cte_wp_at' (\<lambda>_. True) cref s
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv s. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType (unat userSize) destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s\<rbrakk> \<Longrightarrow> (\<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))) - 1) \<longrightarrow> True \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_base sz (if reset then 0 else idx) = cteCap cte) cref s \<and> untyped_ranges_zero' s \<and> is_aligned (word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) 4 \<and> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))) \<le> 2 ^ sz \<and> True \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))) \<and> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))) \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) minUntypedSizeBits) cref s \<and> sch_act_simple s \<and> True \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) (cteCap c) = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) cref s \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (\<lambda>c. (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap c) = capability.NullCap) x s) \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> ex_cte_cap_wp_to' (\<lambda>a. True) x s) \<and> (\<exists>n. gsCNodes s cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> caps_no_overlap'' ptr sz s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s) \<and> cte_wp_at' (\<lambda>a. {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) (cteCap a)) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {} \<and> isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> descendants_range_in' {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} cref (ctes_of s) \<and> cnodes_retype_have_size {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} (APIType_capBits newType (unat userSize)) (gsCNodes s) \<and> cref \<notin> set destSlots \<and> destSlots \<noteq> [] \<and> range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots) \<and> ptr \<noteq> 0 \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) - 1} \<and> 0 \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> is_aligned ptr 4 \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) \<and> unat (word_of_nat (length destSlots)) = length destSlots) \<and> cte_wp_at' (\<lambda>_. True) cref s
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv s. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType (unat userSize) destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s; invokeUntyped_proofs s cref reset ptr_base ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev\<rbrakk> \<Longrightarrow> (\<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))) - 1) \<longrightarrow> True \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_base sz (if reset then 0 else idx) = cteCap cte) cref s \<and> untyped_ranges_zero' s \<and> is_aligned (word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) 4 \<and> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))) \<le> 2 ^ sz \<and> True \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))) \<and> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))) \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) minUntypedSizeBits) cref s \<and> sch_act_simple s \<and> True \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) (cteCap c) = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) cref s \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (\<lambda>c. (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap c) = capability.NullCap) x s) \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> ex_cte_cap_wp_to' (\<lambda>a. True) x s) \<and> (\<exists>n. gsCNodes s cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> caps_no_overlap'' ptr sz s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s) \<and> cte_wp_at' (\<lambda>a. {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) (cteCap a)) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {} \<and> isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> descendants_range_in' {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} cref (ctes_of s) \<and> cnodes_retype_have_size {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} (APIType_capBits newType (unat userSize)) (gsCNodes s) \<and> cref \<notin> set destSlots \<and> destSlots \<noteq> [] \<and> range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots) \<and> ptr \<noteq> 0 \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) - 1} \<and> 0 \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> is_aligned ptr 4 \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) \<and> unat (word_of_nat (length destSlots)) = length destSlots) \<and> cte_wp_at' (\<lambda>_. True) cref s
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch rv s. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType (unat userSize) destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx))) s; invokeUntyped_proofs s cref reset ptr_base ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType us; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28\<rbrakk> \<Longrightarrow> (\<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))) - 1) \<longrightarrow> True \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx \<and> idx \<le> unat (ptr && mask sz)) cref s \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> capability.UntypedCap isdev ptr_base sz (if reset then 0 else idx) = cteCap cte) cref s \<and> untyped_ranges_zero' s \<and> is_aligned (word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) 4 \<and> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))) \<le> 2 ^ sz \<and> True \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> capFreeIndex (cteCap a) \<le> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))) \<and> getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))) \<le> 2 ^ capBlockSize (cteCap a) \<and> is_aligned (word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) minUntypedSizeBits) cref s \<and> sch_act_simple s \<and> True \<and> cte_wp_at' (\<lambda>c. capFreeIndex_update (\<lambda>_. getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) (cteCap c) = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) cref s \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (\<lambda>c. (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap c) = capability.NullCap) x s) \<and> (\<forall>x\<in>set destSlots. cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> ex_cte_cap_wp_to' (\<lambda>a. True) x s) \<and> (\<exists>n. gsCNodes s cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> caps_no_overlap'' ptr sz s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> valid_pspace' s \<and> descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s) \<and> cte_wp_at' (\<lambda>a. {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) (cteCap a)) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {} \<and> isUntypedCap (cteCap a)) cref s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) cref s \<and> descendants_range_in' {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} cref (ctes_of s) \<and> cnodes_retype_have_size {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} (APIType_capBits newType (unat userSize)) (gsCNodes s) \<and> cref \<notin> set destSlots \<and> destSlots \<noteq> [] \<and> range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots) \<and> ptr \<noteq> 0 \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) - 1} \<and> 0 \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> is_aligned ptr 4 \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> unat userSize \<le> maxUntypedSizeBits) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize) \<and> (newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize) \<and> (isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType) \<and> unat (word_of_nat (length destSlots)) = length destSlots) \<and> cte_wp_at' (\<lambda>_. True) cref s
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))) - 1)\<rbrakk> \<Longrightarrow> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) 4 \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))) \<le> 2 ^ sz \<and> (\<not> reset \<longrightarrow> idx \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))) \<le> 2 ^ sz \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) minUntypedSizeBits \<and> (\<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap) \<and> (\<exists>n. gsCNodes s cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {} \<and> cnodes_retype_have_size {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} (APIType_capBits newType (unat userSize)) (gsCNodes s) \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) - 1} \<and> is_aligned ptr 4 \<and> unat (word_of_nat (length destSlots)) = length destSlots
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))) - 1); \<not> reset \<longrightarrow> (if reset then 0 else idx) \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize))\<rbrakk> \<Longrightarrow> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) 4 \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))) \<le> 2 ^ sz \<and> (\<not> reset \<longrightarrow> idx \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))) \<le> 2 ^ sz \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) minUntypedSizeBits \<and> (\<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap) \<and> (\<exists>n. gsCNodes s cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {} \<and> cnodes_retype_have_size {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} (APIType_capBits newType (unat userSize)) (gsCNodes s) \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) - 1} \<and> is_aligned ptr 4 \<and> unat (word_of_nat (length destSlots)) = length destSlots
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))) - 1); \<not> reset \<longrightarrow> (if reset then 0 else idx) \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits\<rbrakk> \<Longrightarrow> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) 4 \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))) \<le> 2 ^ sz \<and> (\<not> reset \<longrightarrow> idx \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))) \<le> 2 ^ sz \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) minUntypedSizeBits \<and> (\<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap) \<and> (\<exists>n. gsCNodes s cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {} \<and> cnodes_retype_have_size {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} (APIType_capBits newType (unat userSize)) (gsCNodes s) \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) - 1} \<and> is_aligned ptr 4 \<and> unat (word_of_nat (length destSlots)) = length destSlots
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) 4 \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))) \<le> 2 ^ sz \<and> (\<not> reset \<longrightarrow> idx \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))) \<le> 2 ^ sz \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) minUntypedSizeBits \<and> (\<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap) \<and> (\<exists>n. gsCNodes s cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {} \<and> cnodes_retype_have_size {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} (APIType_capBits newType (unat userSize)) (gsCNodes s) \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) - 1} \<and> is_aligned ptr 4 \<and> unat (word_of_nat (length destSlots)) = length destSlots
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<and> valid_objs' s \<and> untyped_ranges_zero' s \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) 4 \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz \<and> (\<not> reset \<longrightarrow> idx \<le> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize))) \<and> getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz \<and> is_aligned (word_of_nat (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) minUntypedSizeBits \<and> (\<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap) \<and> (\<exists>n. gsCNodes s cnodeptr = Some n \<and> unat start + length destSlots \<le> 2 ^ n) \<and> pspace_no_overlap' ptr sz s \<and> valid_pspace' s \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {} \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {} \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) - 1} \<and> is_aligned ptr 4 \<and> unat (word_of_nat (length destSlots)) = length destSlots
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr sz s \<and> is_aligned ptr 4 \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<and> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) - 1} \<and> (\<exists>n. gsCNodes s cnodeptr = Some n \<and> length destSlots + unat start \<le> 2 ^ n) \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {} \<and> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz \<and> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> (\<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap) \<and> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (12 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr sz s
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> is_aligned ptr 4
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> (if reset then 0 else idx) \<le> unat (ptr && mask sz)
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) - 1}
 5. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<exists>n. gsCNodes s cnodeptr = Some n \<and> length destSlots + unat start \<le> 2 ^ n
 6. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {}
 7. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 8. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 9. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 10. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> pspace_no_overlap' ptr sz s
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> is_aligned ptr 4
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> (if reset then 0 else idx) \<le> unat (ptr && mask sz)
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) - 1}
 5. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<exists>n. gsCNodes s cnodeptr = Some n \<and> length destSlots + unat start \<le> 2 ^ n
 6. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {}
 7. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 8. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 9. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 10. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> is_aligned ptr 4
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> (if reset then 0 else idx) \<le> unat (ptr && mask sz)
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) - 1}
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<exists>n. gsCNodes s cnodeptr = Some n \<and> length destSlots + unat start \<le> 2 ^ n
 5. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {}
 6. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 7. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 8. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 9. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 10. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> is_aligned ptr 4
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> (if reset then 0 else idx) \<le> unat (ptr && mask sz)
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) - 1}
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<exists>n. gsCNodes s cnodeptr = Some n \<and> length destSlots + unat start \<le> 2 ^ n
 5. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {}
 6. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 7. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 8. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 9. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 10. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> 4 \<le> APIType_capBits newType (unat userSize)
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> (if reset then 0 else idx) \<le> unat (ptr && mask sz)
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) - 1}
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<exists>n. gsCNodes s cnodeptr = Some n \<and> length destSlots + unat start \<le> 2 ^ n
 5. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {}
 6. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 7. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 8. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 9. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 10. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> (if reset then 0 else idx) \<le> unat (ptr && mask sz)
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) - 1}
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<exists>n. gsCNodes s cnodeptr = Some n \<and> length destSlots + unat start \<le> 2 ^ n
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {}
 5. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 6. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 7. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 8. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 9. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 10. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> (if reset then 0 else idx) \<le> unat (ptr && mask sz)
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) - 1}
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<exists>n. gsCNodes s cnodeptr = Some n \<and> length destSlots + unat start \<le> 2 ^ n
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {}
 5. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 6. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 7. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 8. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 9. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 10. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) - 1}
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<exists>n. gsCNodes s cnodeptr = Some n \<and> length destSlots + unat start \<le> 2 ^ n
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {}
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 5. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 6. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 7. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 8. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 9. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> cnodeptr \<notin> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) - 1}
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<exists>n. gsCNodes s cnodeptr = Some n \<and> length destSlots + unat start \<le> 2 ^ n
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {}
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 5. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 6. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 7. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 8. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 9. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) - 1} \<subseteq> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<exists>n. gsCNodes s cnodeptr = Some n \<and> length destSlots + unat start \<le> 2 ^ n
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {}
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 5. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 6. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 7. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 8. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 9. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<exists>n. gsCNodes s cnodeptr = Some n \<and> length destSlots + unat start \<le> 2 ^ n
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {}
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 5. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 6. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 7. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 8. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 9. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<exists>n. gsCNodes s cnodeptr = Some n \<and> length destSlots + unat start \<le> 2 ^ n
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {}
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 5. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 6. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 8. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<exists>n. gsCNodes s cnodeptr = Some n \<and> length destSlots + unat start \<le> 2 ^ n
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {}
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 5. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 6. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 7. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 8. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {}
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 5. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 7. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {}
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 5. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 7. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s); kernel_data_refs \<inter> capRange (cteCap cte) = {} \<and> global_refs' s \<subseteq> kernel_data_refs\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {}
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 5. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 7. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s); kernel_data_refs \<inter> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} = {}; global_refs' s \<subseteq> kernel_data_refs\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<inter> kernel_data_refs = {}
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 5. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 7. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s); global_refs' s \<subseteq> kernel_data_refs\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 5. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 7. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s); global_refs' s \<subseteq> kernel_data_refs\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 5. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 7. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 6. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 6. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s); unat (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) = length destSlots * 2 ^ APIType_capBits newType (unat userSize)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> 2 ^ sz
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 6. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s); unat (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) = length destSlots * 2 ^ APIType_capBits newType (unat userSize)\<rbrakk> \<Longrightarrow> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> length destSlots * 2 ^ APIType_capBits newType (unat userSize) + unat (ptr && mask sz)
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 6. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s); unat (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) = length destSlots * 2 ^ APIType_capBits newType (unat userSize)\<rbrakk> \<Longrightarrow> ptr && mask sz \<le> (ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s); unat (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) = length destSlots * 2 ^ APIType_capBits newType (unat userSize)\<rbrakk> \<Longrightarrow> unat (ptr && mask sz) + unat (word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> length destSlots * 2 ^ APIType_capBits newType (unat userSize) + unat (ptr && mask sz)
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 5. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 6. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 7. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s); unat (word_of_nat (length destSlots) << APIType_capBits newType (unat userSize)) = length destSlots * 2 ^ APIType_capBits newType (unat userSize)\<rbrakk> \<Longrightarrow> unat (ptr && mask sz) + unat (word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) \<le> length destSlots * 2 ^ APIType_capBits newType (unat userSize) + unat (ptr && mask sz)
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 4. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 5. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 6. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 5. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 5. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<subseteq> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 3. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 4. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 5. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 4. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set destSlots. \<exists>cte. ctes_of s x = Some cte \<and> (if x = cref then capFreeIndex_update (\<lambda>_. getFreeIndex (ptr && ~~ mask sz) (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) else id) (cteCap cte) = capability.NullCap
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 4. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>userSize s cte x. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s); x \<in> set destSlots\<rbrakk> \<Longrightarrow> x \<noteq> cref \<and> (x \<noteq> cref \<longrightarrow> (\<exists>cte. ctes_of s x = Some cte \<and> cteCap cte = capability.NullCap))
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 4. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>userSize sa cte x. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes sa cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz sa; ct_active' sa; invs' sa; invokeUntyped_proofs sa cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of sa cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of sa) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of sa slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot sa; sch_act_simple sa; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes sa) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of sa); x \<in> set destSlots; x \<noteq> cref \<and> x \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> ex_cte_cap_wp_to' (\<lambda>_. True) x s\<rbrakk> \<Longrightarrow> x \<noteq> cref \<and> (x \<noteq> cref \<longrightarrow> (\<exists>cte. ctes_of sa x = Some cte \<and> cteCap cte = capability.NullCap))
 2. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 4. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; invokeUntyped_proofs s cref reset (ptr && ~~ mask sz) ptr newType (unat userSize) destSlots sz (if reset then 0 else idx) isdev; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s)\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>userSize s cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 2 ^ cteSizeBits + word_of_nat n * 2 ^ cteSizeBits); us = unat userSize; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; pspace_no_overlap' (if reset then ptr && ~~ mask sz else ptr) sz s; ct_active' s; invs' s; 4 \<le> APIType_capBits newType (unat userSize); newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> 4 \<le> unat userSize \<and> unat userSize \<le> 29; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> (if reset then 0 else idx) \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz (if reset then 0 else idx); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. cteCap cte = capability.NullCap \<and> ctes_of s slot = Some cte; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> 29; \<not> cNodeOverlap (gsCNodes s) (\<lambda>x. ptr \<le> x \<and> x \<le> ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); sz < word_bits; descendants_range_in' {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} cref (ctes_of s); usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}\<rbrakk> \<Longrightarrow> usableUntypedRange (capability.UntypedCap isdev (ptr && ~~ mask sz) sz (unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)))) \<inter> {ptr..ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize) - 1} = {}
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 2. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})),UNIV
 2. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4084 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch\<^esub> (?R'4087 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base) IF reset THEN
  \<acute>status :== CALL resetUntypedCap_'proc(cte_Ptr cref);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update status_'
FI
FI UNIV,(?A'5377 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch)
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> UNIV \<subseteq> ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})
 3. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ?A'5377 destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch \<subseteq> UNIV
 4. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> ?R'4087 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> UNIV \<subseteq> ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ?A'5453 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base \<subseteq> UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> {s. (reset \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, status_' := ret__unsigned_long_' t, ret__unsigned_long_' := ret__unsigned_long_' t, global_exn_var_' := Return\<rparr> \<in> ?A'5453 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v)) \<and> (\<not> reset \<longrightarrow> True)}}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base; sz < LENGTH(32); APIType_capBits newType us \<le> sz; length destSlots + unat (ptr && mask sz >> APIType_capBits newType us) \<le> 2 ^ (sz - APIType_capBits newType us); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType us)\<rbrakk> \<Longrightarrow> UNIV \<subseteq> ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. \<forall>v v'. v = word_of_nat (getObjectSize (object_type_to_H (t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)))) (unat (userObjSize_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s))))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. s \<in> {s. totalObjectSize_'_update (\<lambda>_. destLength << unat v) s \<in> {s. freeRef_'_update (\<lambda>_. ptr + (destLength << unat v)) s \<in> {s'. (\<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType us) s' \<and> heap_list (hrs_mem (t_hrs_' (globals s'))) (length destSlots * 2 ^ APIType_capBits newType us) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType us) 0) \<and> (\<exists>cte cte' idx. cslift s' srcSlot = Some cte' \<and> ccte_relation cte cte' \<and> cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) \<longrightarrow> s' \<in> {s. \<not> capIsDevice (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) \<longrightarrow> region_actually_is_bytes (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) s \<and> heap_list (hrs_mem (t_hrs_' (globals s))) (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) (capPtr (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) + word_of_nat (getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us))))) = replicate (capFreeIndex (capability.UntypedCap isdev ptr_fetch sz (if reset then 0 else idx)) - getFreeIndex ptr_fetch (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType us)))) 0} \<inter> {s. cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> (\<forall>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])))\<lparr>capFreeIndex_CL := (ptr + (destLength << unat v) - ptr_fetch >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<longrightarrow> s \<Turnstile>\<^sub>c srcSlot \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes' ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) (hrs_htd (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) \<and> heap_list (hrs_mem (hrs_mem_update (heap_update (cap_Ptr &(srcSlot\<rightarrow>[''cap_C''])) (ret__struct_cap_C_' t)) (t_hrs_' (globals s)))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0) \<and> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))}} \<inter> \<lbrace>True\<rbrace>}} \<inter> \<lbrace>v < 0x20\<rbrace>}} \<inter> {s. t_' (userObjSize_'_update (\<lambda>_. userSize) (t_'_update (\<lambda>_. newTypea) s)) \<le> word_of_nat (length enum - 1)})
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ?A'5453 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base \<subseteq> UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> {s. (reset \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, status_' := ret__unsigned_long_' t, ret__unsigned_long_' := ret__unsigned_long_' t, global_exn_var_' := Return\<rparr> \<in> ?A'5453 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v)) \<and> (\<not> reset \<longrightarrow> True)}}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>userSize x rv cte cte' idxa. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; sz < 32; APIType_capBits newType (unat userSize) \<le> sz; length destSlots + unat (ptr && mask sz >> APIType_capBits newType (unat userSize)) \<le> 2 ^ (sz - APIType_capBits newType (unat userSize)); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); us = unat userSize; inr_rrel dc rv (xfdc x); \<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) x \<and> heap_list (hrs_mem (t_hrs_' (globals x))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0; cslift x (cte_Ptr cref) = Some cte'; ccte_relation cte cte'; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idxa\<rbrakk> \<Longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes (ptr_base + word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) ((if reset then 0 else idx) - getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) x \<and> heap_list (hrs_mem (t_hrs_' (globals x))) ((if reset then 0 else idx) - getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) (ptr_base + word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) = replicate ((if reset then 0 else idx) - getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) 0) \<and> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := (ptr + (word_of_nat (length destSlots) << unat (word_of_nat (APIType_capBits newType (unat userSize)))) - ptr_base >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ?A'5453 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base \<subseteq> UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> {s. (reset \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, status_' := ret__unsigned_long_' t, ret__unsigned_long_' := ret__unsigned_long_' t, global_exn_var_' := Return\<rparr> \<in> ?A'5453 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v)) \<and> (\<not> reset \<longrightarrow> True)}}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>userSize x rv cte cte' idxa. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; sz < 32; APIType_capBits newType (unat userSize) \<le> sz; length destSlots + unat (ptr && mask sz >> APIType_capBits newType (unat userSize)) \<le> 2 ^ (sz - APIType_capBits newType (unat userSize)); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); us = unat userSize; inr_rrel dc rv (xfdc x); \<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) x \<and> heap_list (hrs_mem (t_hrs_' (globals x))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0; cslift x (cte_Ptr cref) = Some cte'; ccte_relation cte cte'; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idxa; ccap_relation (cteCap cte) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes (ptr_base + word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) ((if reset then 0 else idx) - getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) x \<and> heap_list (hrs_mem (t_hrs_' (globals x))) ((if reset then 0 else idx) - getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) (ptr_base + word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) = replicate ((if reset then 0 else idx) - getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) 0) \<and> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := (ptr + (word_of_nat (length destSlots) << unat (word_of_nat (APIType_capBits newType (unat userSize)))) - ptr_base >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ?A'5453 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base \<subseteq> UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> {s. (reset \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, status_' := ret__unsigned_long_' t, ret__unsigned_long_' := ret__unsigned_long_' t, global_exn_var_' := Return\<rparr> \<in> ?A'5453 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v)) \<and> (\<not> reset \<longrightarrow> True)}}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>userSize x rv cte cte' idxa. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; sz < 32; APIType_capBits newType (unat userSize) \<le> sz; length destSlots + unat (ptr && mask sz >> APIType_capBits newType (unat userSize)) \<le> 2 ^ (sz - APIType_capBits newType (unat userSize)); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); us = unat userSize; inr_rrel dc rv (xfdc x); \<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) x \<and> heap_list (hrs_mem (t_hrs_' (globals x))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0; cslift x (cte_Ptr cref) = Some cte'; ccte_relation cte cte'; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idxa; ccap_relation (cteCap cte) (cte_C.cap_C cte'); valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) s\<rbrakk> \<Longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes (ptr_base + word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) ((if reset then 0 else idx) - getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) x \<and> heap_list (hrs_mem (t_hrs_' (globals x))) ((if reset then 0 else idx) - getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) (ptr_base + word_of_nat (getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize)))))) = replicate ((if reset then 0 else idx) - getFreeIndex ptr_base (ptr + word_of_nat (shiftL (length destSlots) (APIType_capBits newType (unat userSize))))) 0) \<and> cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap \<and> ((\<exists>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := (ptr + (word_of_nat (length destSlots) << unat (word_of_nat (APIType_capBits newType (unat userSize)))) - ptr_base >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ?A'5453 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base \<subseteq> UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> {s. (reset \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, status_' := ret__unsigned_long_' t, ret__unsigned_long_' := ret__unsigned_long_' t, global_exn_var_' := Return\<rparr> \<in> ?A'5453 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v)) \<and> (\<not> reset \<longrightarrow> True)}}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>userSize x rv cte cte' idxa ctea. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; sz < 32; APIType_capBits newType (unat userSize) \<le> sz; length destSlots + unat (ptr && mask sz >> APIType_capBits newType (unat userSize)) \<le> 2 ^ (sz - APIType_capBits newType (unat userSize)); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); us = unat userSize; inr_rrel dc rv (xfdc x); \<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) x \<and> heap_list (hrs_mem (t_hrs_' (globals x))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0; cslift x (cte_Ptr cref) = Some cte'; ccte_relation cte cte'; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idxa; ccap_relation (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idxa) (cte_C.cap_C cte'); range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some ctea; \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap ctea = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx; ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes (ptr + 2 ^ APIType_capBits newType (unat userSize) * word_of_nat (length destSlots)) 0 x) \<and> ((\<exists>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := (ptr + (word_of_nat (length destSlots) << unat (word_of_nat (APIType_capBits newType (unat userSize)))) - (ptr && ~~ mask sz) >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10))) \<and> (\<not> reset \<longrightarrow> (\<not> isdev \<longrightarrow> region_actually_is_bytes (ptr + 2 ^ APIType_capBits newType (unat userSize) * word_of_nat (length destSlots)) (idx - unat (ptr + 2 ^ APIType_capBits newType (unat userSize) * word_of_nat (length destSlots) - (ptr && ~~ mask sz))) x \<and> heap_list (hrs_mem (t_hrs_' (globals x))) (idx - unat (ptr + 2 ^ APIType_capBits newType (unat userSize) * word_of_nat (length destSlots) - (ptr && ~~ mask sz))) (ptr + 2 ^ APIType_capBits newType (unat userSize) * word_of_nat (length destSlots)) = replicate (idx - unat (ptr + 2 ^ APIType_capBits newType (unat userSize) * word_of_nat (length destSlots) - (ptr && ~~ mask sz))) 0) \<and> ((\<exists>t. cap_untyped_cap_lift (ret__struct_cap_C_' t) = cap_untyped_cap_lift (cte_C.cap_C cte')\<lparr>capFreeIndex_CL := (ptr + (word_of_nat (length destSlots) << unat (word_of_nat (APIType_capBits newType (unat userSize)))) - (ptr && ~~ mask sz) >> 4) && mask 26\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap) \<longrightarrow> (\<forall>n<length destSlots. (start + word_of_nat n) * 2 ^ cteSizeBits = start * 0x10 + word_of_nat n * 0x10)))
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ?A'5453 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base \<subseteq> UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> {s. (reset \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, status_' := ret__unsigned_long_' t, ret__unsigned_long_' := ret__unsigned_long_' t, global_exn_var_' := Return\<rparr> \<in> ?A'5453 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v)) \<and> (\<not> reset \<longrightarrow> True)}}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>userSize x rv cte cte' idxa ctea. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start * 0x10 + word_of_nat n * 0x10); sz < 32; APIType_capBits newType (unat userSize) \<le> sz; length destSlots + unat (ptr && mask sz >> APIType_capBits newType (unat userSize)) \<le> 2 ^ (sz - APIType_capBits newType (unat userSize)); \<not> reset \<longrightarrow> idx \<le> unat ((ptr && mask sz) + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)); us = unat userSize; inr_rrel dc rv (xfdc x); \<not> isdev \<longrightarrow> region_actually_is_bytes ptr (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) x \<and> heap_list (hrs_mem (t_hrs_' (globals x))) (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) ptr = replicate (length destSlots * 2 ^ APIType_capBits newType (unat userSize)) 0; cslift x (cte_Ptr cref) = Some cte'; ccte_relation cte cte'; cteCap cte = capability.UntypedCap isdev (ptr - (ptr && mask sz)) sz idxa; ccap_relation (capability.UntypedCap isdev (ptr - (ptr && mask sz)) sz idxa) (cte_C.cap_C cte'); range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some ctea; \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr && mask sz = 0; cteCap ctea = capability.UntypedCap isdev (ptr - (ptr && mask sz)) sz idx; ptr_base + (ptr && mask sz) = ptr; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; sch_act_simple s; destSlots \<noteq> []; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> \<not> isdev \<longrightarrow> region_actually_is_bytes (ptr + word_of_nat (length destSlots) * 2 ^ APIType_capBits newType (unat userSize)) 0 x
 2. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ?A'5453 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base \<subseteq> UNIV
 3. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> {s. (reset \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, status_' := ret__unsigned_long_' t, ret__unsigned_long_' := ret__unsigned_long_' t, global_exn_var_' := Return\<rparr> \<in> ?A'5453 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v)) \<and> (\<not> reset \<longrightarrow> True)}}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>destLength destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase ptr_fetch. \<lbrakk>destLength = word_of_nat (length destSlots); \<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; ptr_fetch = ptr_base\<rbrakk> \<Longrightarrow> ?A'5453 (word_of_nat (length destSlots)) start (cte_Ptr cnodeptr) (from_bool isdev) userSize (object_type_from_H newType) (from_bool reset) (cte_Ptr cref) (PTR(unit) ptr) ptr_base \<subseteq> UNIV
 2. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>va. status_'_update (\<lambda>_. va) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> {s. (reset \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, status_' := ret__unsigned_long_' t, ret__unsigned_long_' := ret__unsigned_long_' t, global_exn_var_' := Return\<rparr> \<in> ?A'5453 destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase v)) \<and> (\<not> reset \<longrightarrow> True)}}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>v. status_'_update (\<lambda>_. v) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> {s. (reset \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, status_' := ret__unsigned_long_' t, ret__unsigned_long_' := ret__unsigned_long_' t, global_exn_var_' := Return\<rparr> \<in> UNIV)) \<and> (\<not> reset \<longrightarrow> True)}}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>destLength destOffset destCNode deviceMemory userSize newTypea reseta srcSlot retypeBase sa s'. \<lbrakk>destLength = word_of_nat (length destSlots); destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits); destCNode = cte_Ptr cnodeptr; deviceMemory = from_bool isdev; unat userSize = us; newTypea = object_type_from_H newType; reseta = from_bool reset; srcSlot = cte_Ptr cref; retypeBase = PTR(unit) ptr; (sa, s') \<in> rf_sr; sa = s; s' \<in> UNIV; ct_active' s; invs' s; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; destSlots \<noteq> []; ptr_base && ~~ mask sz = ptr_base; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> us < 28; invokeUntyped_proofs s cref reset ptr_base ptr newType us destSlots sz idx isdev; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < us; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> us \<and> us \<le> maxUntypedSizeBits; 4 \<le> APIType_capBits newType us; cref \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\<rbrakk> \<Longrightarrow> ((\<lambda>a. (reset \<longrightarrow> (invs' and sch_act_simple and ct_active' and cte_wp_at' (isUntypedCap \<circ> cteCap) cref and (\<lambda>s. descendants_of' cref (ctes_of s) = {}) and (\<lambda>a. True \<and> True)) a) \<and> (\<not> reset \<longrightarrow> True)) and ((\<lambda>a. (reset \<longrightarrow> ((\<lambda>s. case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> cnodeptr \<notin> untypedRange (cteCap cte)) cref and valid_objs') a) \<and> (\<not> reset \<longrightarrow> (case gsCNodes a cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat destOffset \<le> 2 ^ n))) and (invs' and valid_untyped_inv_wcap' (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev) (Some (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx)) and ct_active' and K (\<exists>ptr_basea ty usa slots. Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev = Invocations_H.untyped_invocation.Retype cref reset ptr_basea ptr ty usa slots isdev))) and cte_wp_at' (\<lambda>_. True) (ptr_val srcSlot)) sa \<and> s' \<in> {s. \<forall>v v'. v = capPtr_CL (cap_untyped_cap_lift (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> \<lbrace>v = capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))))\<rbrace> \<longrightarrow> s \<in> {s. regionBase_'_update (\<lambda>_. PTR(unit) v) s \<in> {s. \<forall>v. status_'_update (\<lambda>_. v) s \<in> {s. (reset \<longrightarrow> s \<in> {s. srcSlot_'_update (\<lambda>_. srcSlot) s \<in> UNIV \<inter> \<lbrace>\<acute>srcSlot = srcSlot\<rbrace>} \<inter> {s. \<forall>t. id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (ret__unsigned_long_' t)) \<longrightarrow> inr_rrel dc (Inr rv) (xfdc (status_'_update (\<lambda>_. ret__unsigned_long_' t) (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>))))}) \<and> (\<not> reset \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})} \<inter> {s. (reset \<longrightarrow> (\<forall>t. ret__unsigned_long_' t \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>, status_' := ret__unsigned_long_' t, ret__unsigned_long_' := ret__unsigned_long_' t, global_exn_var_' := Return\<rparr> \<in> UNIV)) \<and> (\<not> reset \<longrightarrow> True)}}} \<inter> \<lbrace>v = ptr_base\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(srcSlot\<rightarrow>[''cap_C'']))) s)) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap} \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>userSize s' cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; (s, s') \<in> rf_sr; ct_active' s; invs' s; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; destSlots \<noteq> []; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; 4 \<le> APIType_capBits newType (unat userSize); cref \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; us = unat userSize; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx; ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cnodeptr \<notin> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> valid_objs' s) \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])))) = ptr && ~~ mask sz \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap proof (prove)
goal (1 subgoal):
 1. \<And>userSize s' cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; (s, s') \<in> rf_sr; ct_active' s; invs' s; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; destSlots \<noteq> []; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; 4 \<le> APIType_capBits newType (unat userSize); cref \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; us = unat userSize; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx; ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits; valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cnodeptr \<notin> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1} \<and> valid_objs' s) \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])))) = ptr && ~~ mask sz \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap proof (prove)
goal (1 subgoal):
 1. \<And>userSize s' cte. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; (s, s') \<in> rf_sr; st_tcb_at' active' (ksCurThread s) s; invs' s; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; destSlots \<noteq> []; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; 4 \<le> APIType_capBits newType (unat userSize); cref \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; us = unat userSize; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ctes_of s cref = Some cte; \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx; ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits; sz < word_bits; valid_untyped' isdev (ptr && ~~ mask sz) sz idx s; ptr && ~~ mask sz \<noteq> 0; minUntypedSizeBits \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cnodeptr \<notin> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}) \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])))) = ptr && ~~ mask sz \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap proof (prove)
goal (1 subgoal):
 1. \<And>userSize s' cte cte' ctel'. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; (s, s') \<in> rf_sr; st_tcb_at' active' (ksCurThread s) s; invs' s; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; destSlots \<noteq> []; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; 4 \<le> APIType_capBits newType (unat userSize); cref \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; us = unat userSize; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx; ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits; sz < word_bits; valid_untyped' isdev (ptr && ~~ mask sz) sz idx s; ptr && ~~ mask sz \<noteq> 0; minUntypedSizeBits \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; is_aligned (word_of_nat idx) minUntypedSizeBits; ctes_of s cref = Some (cte_to_H ctel'); cslift s' (cte_Ptr cref) = Some cte'; cte_lift cte' = Some ctel'; cte = cte_to_H ctel'; cl_valid_cte ctel'\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cnodeptr \<notin> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}) \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])))) = ptr && ~~ mask sz \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap proof (prove)
goal (1 subgoal):
 1. \<And>userSize s' cte cte' ctel'. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; (s, s') \<in> rf_sr; st_tcb_at' active' (ksCurThread s) s; invs' s; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; destSlots \<noteq> []; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; 4 \<le> APIType_capBits newType (unat userSize); cref \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; us = unat userSize; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cteCap cte = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx; ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits; sz < word_bits; valid_untyped' isdev (ptr && ~~ mask sz) sz idx s; ptr && ~~ mask sz \<noteq> 0; minUntypedSizeBits \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; is_aligned (word_of_nat idx) minUntypedSizeBits; ctes_of s cref = Some (cte_to_H ctel'); cslift s' (cte_Ptr cref) = Some cte'; cte_lift cte' = Some ctel'; cte = cte_to_H ctel'; cl_valid_cte ctel'; ccte_relation (cte_to_H ctel') cte'\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cnodeptr \<notin> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}) \<and> capPtr_CL (cap_untyped_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C''])))) = ptr && ~~ mask sz \<and> cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr cref\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap proof (prove)
goal (1 subgoal):
 1. \<And>userSize s' cte' ctel'. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; (s, s') \<in> rf_sr; st_tcb_at' active' (ksCurThread s) s; invs' s; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; destSlots \<noteq> []; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; 4 \<le> APIType_capBits newType (unat userSize); cref \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; us = unat userSize; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cap_to_H (cap_CL ctel') = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx; ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits; sz < word_bits; valid_untyped' isdev (ptr && ~~ mask sz) sz idx s; ptr && ~~ mask sz \<noteq> 0; minUntypedSizeBits \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; is_aligned (word_of_nat idx) minUntypedSizeBits; ctes_of s cref = Some (cte_to_H ctel'); cslift s' (cte_Ptr cref) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccap_relation (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) (cte_C.cap_C cte')\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cnodeptr \<notin> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}) \<and> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) = ptr && ~~ mask sz proof (prove)
goal (1 subgoal):
 1. \<And>userSize s' cte' ctel'. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; (s, s') \<in> rf_sr; st_tcb_at' active' (ksCurThread s) s; invs' s; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; destSlots \<noteq> []; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; 4 \<le> APIType_capBits newType (unat userSize); cref \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; us = unat userSize; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cap_to_H (cap_CL ctel') = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx; ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits; sz < word_bits; valid_untyped' isdev (ptr && ~~ mask sz) sz idx s; ptr && ~~ mask sz \<noteq> 0; minUntypedSizeBits \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; is_aligned (word_of_nat idx) minUntypedSizeBits; ctes_of s cref = Some (cte_to_H ctel'); cslift s' (cte_Ptr cref) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccap_relation (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) (cte_C.cap_C cte'); cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> (reset \<longrightarrow> cnodeptr \<notin> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}) \<and> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) = ptr && ~~ mask sz proof (prove)
goal (2 subgoals):
 1. \<And>userSize s' cte' ctel'. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; (s, s') \<in> rf_sr; st_tcb_at' active' (ksCurThread s) s; invs' s; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; destSlots \<noteq> []; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; 4 \<le> APIType_capBits newType (unat userSize); cref \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; us = unat userSize; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cap_to_H (cap_CL ctel') = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx; ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits; sz < word_bits; valid_untyped' isdev (ptr && ~~ mask sz) sz idx s; ptr && ~~ mask sz \<noteq> 0; minUntypedSizeBits \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; is_aligned (word_of_nat idx) minUntypedSizeBits; ctes_of s cref = Some (cte_to_H ctel'); cslift s' (cte_Ptr cref) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccap_relation (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) (cte_C.cap_C cte'); cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> reset \<longrightarrow> cnodeptr \<notin> {ptr && ~~ mask sz..(ptr && ~~ mask sz) + 2 ^ sz - 1}
 2. \<And>userSize s' cte' ctel'. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; (s, s') \<in> rf_sr; st_tcb_at' active' (ksCurThread s) s; invs' s; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; destSlots \<noteq> []; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; 4 \<le> APIType_capBits newType (unat userSize); cref \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; us = unat userSize; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cap_to_H (cap_CL ctel') = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx; ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits; sz < word_bits; valid_untyped' isdev (ptr && ~~ mask sz) sz idx s; ptr && ~~ mask sz \<noteq> 0; minUntypedSizeBits \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; is_aligned (word_of_nat idx) minUntypedSizeBits; ctes_of s cref = Some (cte_to_H ctel'); cslift s' (cte_Ptr cref) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccap_relation (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) (cte_C.cap_C cte'); cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) = ptr && ~~ mask sz proof (prove)
goal (2 subgoals):
 1. \<And>userSize s' cte' ctel'. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; (s, s') \<in> rf_sr; st_tcb_at' active' (ksCurThread s) s; invs' s; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; destSlots \<noteq> []; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; 4 \<le> APIType_capBits newType (unat userSize); cref \<notin> {ptr..ptr + 2 ^ sz - 1}; us = unat userSize; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ptr = ptr && ~~ mask sz; cap_to_H (cap_CL ctel') = capability.UntypedCap isdev ptr sz idx; ptr_base = ptr; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits; sz < word_bits; valid_untyped' isdev ptr sz idx s; ptr \<noteq> 0; minUntypedSizeBits \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; is_aligned (word_of_nat idx) minUntypedSizeBits; ctes_of s cref = Some (cte_to_H ctel'); cslift s' (cte_Ptr cref) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccap_relation (capability.UntypedCap isdev ptr sz idx) (cte_C.cap_C cte'); cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; reset; cnodeptr \<in> {ptr..ptr + 2 ^ sz - 1}; descendants_of' cref (ctes_of s) = {}\<rbrakk> \<Longrightarrow> False
 2. \<And>userSize s' cte' ctel'. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; (s, s') \<in> rf_sr; st_tcb_at' active' (ksCurThread s) s; invs' s; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; destSlots \<noteq> []; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; 4 \<le> APIType_capBits newType (unat userSize); cref \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; us = unat userSize; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cap_to_H (cap_CL ctel') = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx; ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits; sz < word_bits; valid_untyped' isdev (ptr && ~~ mask sz) sz idx s; ptr && ~~ mask sz \<noteq> 0; minUntypedSizeBits \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; is_aligned (word_of_nat idx) minUntypedSizeBits; ctes_of s cref = Some (cte_to_H ctel'); cslift s' (cte_Ptr cref) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccap_relation (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) (cte_C.cap_C cte'); cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) = ptr && ~~ mask sz proof (prove)
goal (2 subgoals):
 1. \<And>userSize s' cte' ctel'. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; (s, s') \<in> rf_sr; st_tcb_at' active' (ksCurThread s) s; invs' s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; destSlots \<noteq> []; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; 4 \<le> APIType_capBits newType (unat userSize); cref \<notin> {ptr..ptr + 2 ^ sz - 1}; us = unat userSize; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); ptr = ptr && ~~ mask sz; cap_to_H (cap_CL ctel') = capability.UntypedCap isdev ptr sz idx; ptr_base = ptr; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits; sz < word_bits; valid_untyped' isdev ptr sz idx s; ptr \<noteq> 0; minUntypedSizeBits \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; is_aligned (word_of_nat idx) minUntypedSizeBits; ctes_of s cref = Some (cte_to_H ctel'); cslift s' (cte_Ptr cref) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccap_relation (capability.UntypedCap isdev ptr sz idx) (cte_C.cap_C cte'); cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; reset; cnodeptr \<in> {ptr..ptr + 2 ^ sz - 1}; descendants_of' cref (ctes_of s) = {}; cnodeptr \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}\<rbrakk> \<Longrightarrow> False
 2. \<And>userSize s' cte' ctel'. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; (s, s') \<in> rf_sr; st_tcb_at' active' (ksCurThread s) s; invs' s; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; destSlots \<noteq> []; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; 4 \<le> APIType_capBits newType (unat userSize); cref \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; us = unat userSize; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cap_to_H (cap_CL ctel') = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx; ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits; sz < word_bits; valid_untyped' isdev (ptr && ~~ mask sz) sz idx s; ptr && ~~ mask sz \<noteq> 0; minUntypedSizeBits \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; is_aligned (word_of_nat idx) minUntypedSizeBits; ctes_of s cref = Some (cte_to_H ctel'); cslift s' (cte_Ptr cref) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccap_relation (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) (cte_C.cap_C cte'); cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) = ptr && ~~ mask sz proof (prove)
goal (1 subgoal):
 1. \<And>userSize s' cte' ctel'. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; (s, s') \<in> rf_sr; st_tcb_at' active' (ksCurThread s) s; invs' s; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; destSlots \<noteq> []; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; 4 \<le> APIType_capBits newType (unat userSize); cref \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; us = unat userSize; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cap_to_H (cap_CL ctel') = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx; ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits; sz < word_bits; valid_untyped' isdev (ptr && ~~ mask sz) sz idx s; ptr && ~~ mask sz \<noteq> 0; minUntypedSizeBits \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; is_aligned (word_of_nat idx) minUntypedSizeBits; ctes_of s cref = Some (cte_to_H ctel'); cslift s' (cte_Ptr cref) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccap_relation (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) (cte_C.cap_C cte'); cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap\<rbrakk> \<Longrightarrow> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) = ptr && ~~ mask sz proof (prove)
goal (1 subgoal):
 1. \<And>userSize s' cte' ctel'. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; (s, s') \<in> rf_sr; st_tcb_at' active' (ksCurThread s) s; invs' s; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; isdev \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; destSlots \<noteq> []; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; 4 \<le> APIType_capBits newType (unat userSize); cref \<notin> {ptr..(ptr && ~~ mask sz) + 2 ^ sz - 1}; us = unat userSize; range_cover ptr sz (APIType_capBits newType (unat userSize)) (length destSlots); \<not> reset \<and> idx \<le> unat (ptr && mask sz) \<or> reset \<and> ptr = ptr && ~~ mask sz; cap_to_H (cap_CL ctel') = capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx; ptr_base = ptr && ~~ mask sz; reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits; sz < word_bits; valid_untyped' isdev (ptr && ~~ mask sz) sz idx s; ptr && ~~ mask sz \<noteq> 0; minUntypedSizeBits \<le> sz; sz \<le> maxUntypedSizeBits; idx \<le> 2 ^ sz; is_aligned (word_of_nat idx) minUntypedSizeBits; ctes_of s cref = Some (cte_to_H ctel'); cslift s' (cte_Ptr cref) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccap_relation (capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx) (cte_C.cap_C cte'); cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; capability.UntypedCap isdev (ptr && ~~ mask sz) sz idx = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte')))) (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'))) (unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte')))) (unat (capFreeIndex_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) << 4))\<rbrakk> \<Longrightarrow> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) = ptr && ~~ mask sz proof (prove)
goal (1 subgoal):
 1. \<And>userSize s' cte' ctel'. \<lbrakk>\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits; (s, s') \<in> rf_sr; st_tcb_at' active' (ksCurThread s) s; invs' s; ex_cte_cap_wp_to' (\<lambda>_. True) cnodeptr s; case gsCNodes s cnodeptr of None \<Rightarrow> False | Some n \<Rightarrow> length destSlots + unat start \<le> 2 ^ n; to_bool (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'))) \<longrightarrow> newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<or> isFrameType newType; destSlots \<noteq> []; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> unat userSize < 28; newType = APIObjectType ArchTypes_H.apiobject_type.CapTableObject \<longrightarrow> 0 < unat userSize; newType = APIObjectType ArchTypes_H.apiobject_type.Untyped \<longrightarrow> minUntypedSizeBits \<le> unat userSize \<and> unat userSize \<le> maxUntypedSizeBits; 4 \<le> APIType_capBits newType (unat userSize); cref \<notin> {ptr..(ptr && ~~ mask (unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'))))) + 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'))) - 1}; us = unat userSize; range_cover ptr (unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte')))) (APIType_capBits newType (unat userSize)) (length destSlots); \<not> reset \<and> unat (capFreeIndex_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) << 4) \<le> unat (ptr && mask (unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'))))) \<or> reset \<and> ptr = ptr && ~~ mask (unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte')))); cap_to_H (cap_CL ctel') = capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte')))) (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'))) (unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte')))) (unat (capFreeIndex_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) << 4)); ptr_base = ptr && ~~ mask (unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte')))); reset \<longrightarrow> descendants_of' cref (ctes_of s) = {}; cref \<notin> set destSlots; distinct destSlots; \<forall>slot\<in>set destSlots. \<exists>cte. ctes_of s slot = Some cte \<and> cteCap cte = capability.NullCap; \<forall>slot\<in>set destSlots. ex_cte_cap_wp_to' (\<lambda>_. True) slot s; ksSchedulerAction s = ResumeCurrentThread \<or> ksSchedulerAction s = ChooseNewThread; APIType_capBits newType (unat userSize) \<le> maxUntypedSizeBits; unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'))) < word_bits; valid_untyped' (to_bool (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte')))) (ptr && ~~ mask (unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'))))) (unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte')))) (unat (capFreeIndex_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) << 4)) s; ptr && ~~ mask (unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte')))) \<noteq> 0; minUntypedSizeBits \<le> unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'))); unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'))) \<le> maxUntypedSizeBits; unat (capFreeIndex_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) << 4) \<le> 2 ^ unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'))); is_aligned (capFreeIndex_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) << 4) minUntypedSizeBits; ctes_of s cref = Some (cte_to_H ctel'); cslift s' (cte_Ptr cref) = Some cte'; cte_lift cte' = Some ctel'; cl_valid_cte ctel'; ccap_relation (capability.UntypedCap (to_bool (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte')))) (capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte'))) (unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte')))) (unat (capFreeIndex_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) << 4))) (cte_C.cap_C cte'); cap_get_tag (cte_C.cap_C cte') = SCAST(32 signed \<rightarrow> 32) cap_untyped_cap; isdev = to_bool (capIsDevice_CL (cap_untyped_cap_lift (cte_C.cap_C cte'))) \<and> ptr && ~~ mask sz = capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) \<and> sz = unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte'))) \<and> idx = unat (capFreeIndex_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) << 4)\<rbrakk> \<Longrightarrow> capPtr_CL (cap_untyped_cap_lift (cte_C.cap_C cte')) = ptr && ~~ mask (unat (capBlockSize_CL (cap_untyped_cap_lift (cte_C.cap_C cte')))) proof (prove)
goal:
No subgoals! proof (state)
this:
ccorres (cintr \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>s'. s' = s) (UNIV \<inter> \<lbrace>\<acute>retypeBase = PTR(unit) ptr\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr cref\<rbrace> \<inter> \<lbrace>\<acute>reset = from_bool reset\<rbrace> \<inter> \<lbrace>\<acute>newType = object_type_from_H newType\<rbrace> \<inter> \<lbrace>unat \<acute>userSize = us\<rbrace> \<inter> \<lbrace>\<acute>deviceMemory = from_bool isdev\<rbrace> \<inter> \<lbrace>\<acute>destCNode = cte_Ptr cnodeptr\<rbrace> \<inter> \<lbrace>\<acute>destOffset = start \<and> (\<forall>n<length destSlots. destSlots ! n = cnodeptr + (start + word_of_nat n) * 2 ^ cteSizeBits)\<rbrace> \<inter> \<lbrace>\<acute>destLength = word_of_nat (length destSlots)\<rbrace>) [] (invokeUntyped (Invocations_H.untyped_invocation.Retype cref reset ptr_base ptr newType us destSlots isdev)) (Call invokeUntyped_Retype_'proc)

goal:
No subgoals!